Hello to everyone out there in open networking world. We really wish that we were able to be together in person, but we are still living in this world of taking our health seriously. We have what is a super session today. We have both an incredibly amazing and interesting presentation from a number of experts within China Mobile, followed by a panel with experts and executives from China Mobile and Verizon. You are getting basically a double dose of expertise from some of the most important and significant operators in the world in this session. So I hope that you are prepared to take this ride because it's going to be a great one. So as I said, that is the structure of our session today and we are going to start with a presentation coming from four experts at China Mobile. We have Leihuang, Yan Yang, Yuhan Zhang and Casey Liu. All of him are incredibly well-versed scholars and researchers who are doing the work to transform the largest mobile operator on our planet. And so with that, I would like to hand it over to Leihuang to start the presentation. Hello, everyone. Welcome to the session, the state of telecom operators adoption of intelligent networking. As the most popular technical field in recent years, AI has been widely used and researched in communication industry network management, operation and maintenance are traditional communication industry services. Operators and vendors have done a lot of exploration on how to make network management more automatic. However, automation is not enough under the current technology trend. We should make the network intelligent and autonomous. So today we have scheduled this session for sharing the state of telecom operators adoption of intelligent networking. This session consists of two decks, presentation deck and panel deck. Let's start with the presentation deck. In the presentation, we will firstly introduce what is intelligent networking, then share with you about what operators have done in trying to build intelligent networking ecosystem, include ELAG intelligent networking survey, white paper and some other current works across community organization, and we'll introduce some specific best practice from operators. In the end, we provide recommendations for reference. Last of work we did in the early stage was networking. So what exactly is network intelligence? Combining the current definition of network intelligence by various organizations will give a reference explanation that is network empowered by AI technologies and systematic integration of AI and communication network on hardware, software systems and processes to realize lower cost, higher efficiency and agile business. And currently there are various open source and standards organizations that have contributed their efforts in the process of exploring the realization of network intelligence. In order to deeper understand current status of network intelligence in industry, the Elephant ELAG organized a large scale survey in Elephant at the beginning of the year. This is in this topic, we will firstly introduce the survey and analysis combined with ELAG current work. We will start out and share ECSP's requirements and explorations in AI and intelligent networking. You have as the main contributor will share with us both the survey and the follow-up white paper. Let's welcome Rehan. Okay, thank you Le. Today I'm glad to have this opportunity to present our work on intelligent networking and AI survey and white paper. Please down please. The intelligent networking survey is DOH's first survey that opened it to the NPR and AFRN community. A total of 65 people participated and those participants covered such a wide grant. We consider that survey result data could basically represent the requirements of AI industry. Please down. The survey contains these six parts. Based on the feedback from survey, we conducted an in-depth analysis, but consider the season time is limited. We only take a brief introduction about some key findings from the survey feedback. Please down please. The first key finding is about intelligent networking's current progress in industry. As you can see from this page, nearly half of operators are still in early stage opposite O&M, and only about 16% of vendors have a long-term plan for scale development of AI into their architecture of products. In general telecom industry is still in early stages of intelligent transformation with relatively low-level autonomous networks. Please down please. The second key finding is about strategy for improving intelligent networking. We could find that leading operators and vendors would use an account in its intelligent network application through unified AI platforms. A consensus could be reached that developing unified platform is essential to improve network autonomy. Please down please. The third key finding is about application scenarios, top three AI application scenarios are the industry most interested in terms of 2B operations and maintenance, service assurance and network optimization. AI has been put highest expectations on those scenarios since they are those one directly serving customers and frontline operators. Please down please. In terms of ecology strategy a conclusion could be reached that industry are currently in need of both specification and open certification of intelligent network service and network AI algorithms. Please down please. Thank you. In terms of the engagement of different ICOs and OISs ORAN, CENGPP and ITI-UT are the most popular ones among the respondents engaged in nearly half of the respondents are engaged in ONAP and ORAN. Please down please. And the the bow is a brief introduction for the survey and analysis from the results of the survey. We can get the current status of the industry and the development demands on the industry. Based on the survey analysis results and the SESP requirements the UAG is publishing intelligent networking and ML white paper to identify and highlight the last state thinking and commendations for building and supporting intelligent networking. In particular we first introduce motivation and definition and they are conducted detailed analysis and non-meaning on the network intelligence survey by some results of the survey analysis combined with the current operator work priorities we have collected in UAG and we put forward suggestions for the development of the network intelligence industry from the operator's perspective. Finally, the suggestions and the requirements are implemented to put forward a call to action for construction of the intelligent network because it's that's all. Thank you. Thank you for the good introduction and this white paper as you can see in the screen it will be published in October UAG will successfully successfully hold various meeting form from October to November to promote this white paper include our one summits and in the follow up we will also launch a series of webinars with Elephant to promote the white paper. Welcome to download and read this white paper. We believe you will learn about the development trends of intelligent networking you care about. The next work we have done is UAG data and model sharing project. The reason why we propose this project is that data standardization share data sets and models at a long-term challenges of intelligent transformation that operators must deal with and basic data algorithm framework is also the most required capabilities provided by unified intelligent network platforms. In order to help bridge the work between operators and manufacturers and enable operators and vendors to share data sets and models we have established this project and we work with tech to promote this project to collect network intelligence scenarios from operators and vendors. One of the project we are currently implementing with Anocate is AI ML for telecom cloud use cases. From the feedback of the survey, the highest priority to work on is testing and certification services for intelligent network. Today I have invited Yan Yang who is the CVC Vice Chair to share with us the collaboration work between CVC and us. Welcome Yan Yang. Thank you. Next we will give a brief introduction of the testing and certification for network intelligence from EOAG survey, lack of quantitative indicators and certification service is a problem that must solve from partial autonomy to high-level autonomy. So beauty and open and effectiveness evaluation system has become high priority industry demand. So in order to promote this work, CVC and EOAG are working together to collecting their testing and certification requirements and plan to launch the new branch of Anocate Assurance program to accelerate the development of next generation AAP badges for intelligent networking focus on supporting the telecoms adoption and deployment of network intelligent technologies and exploring their best practice from the full industry. So if you are interested in this work, welcome to John. Thanks. Thank you Yan. After the introduction of the current EOAG work in building an intelligent network ecosystem, we hope to share with you the current operators' exploration and practice through some typical operator practice cases and hope to bring you source and resonance. In this part, I have invited China Mobile's representative Kai Xi to bring us the current practice of China Mobile in the process of exploring and developing network intelligence. Welcome, Kai Xi. I'll take it from here. In this chapter with great pleasure, I'll share with you some of our best practices in exploring network intelligence. Next page, please. Hello. In July this year, China Mobile has issued the first best practice white paper. We have officially set the target of reaching L4 level autonomous network by 2025 with the most complex and large-scale network in China and, in fact, on this planet in terms of number of users, we spend $140 billion on network operation and maintenance every year. So this project is supposed to save us a huge cost and offer better service assurance, deliver automated user experience at the same time. Next page, please. So to achieve this goal, we have developed the closed loop evolution path. Following the top design, every round of evolution starts from level evaluation to identify the common shortcomings. This way, coordinated planning and targeted measures could then be made to tackle the problem and progress could then be made. These will be first implemented in selected subnet to verify the feasibility and effectiveness value. High-value use cases will then be widely adopted. So far, we have successfully launched almost 80 pilot use cases in more than 27 provincial companies of China mainland, covering whole life cycle of network planning, deployment, maintenance, optimization and operation. Next please. Here we have chosen 7 typical use cases successfully deployed and well verified in provincial companies highlighting the business values or quantitative results created by each one. Taking the last one example, the intelligent IDC refrigeration with this use case adopted on the health network, estimated 220 million kilowatts could be saved each year. This will not only achieve lower cost for operators, but also a great step to promote sustainable development and low carbon production. And that's all for my part. Thank you. Thank you, Kai Xi for the good sharing of China Boba House best practice. Based on the current status of our industry practice and combined with the several results of this survey, we think that telecom industry is still in early stage of intelligent transformation with relatively low level autonomous networks in terms of which EOAG will continue to focus on building intelligent networking ecosystem through collect operators, AI and our requirements, collaborate with and promote relevant resource open source communities and project. And consider from specific perspective we have write down some of the recommendations here for your reference and we will talk about it in our panel deck. About the horror content of the slides, thank you everyone for hearing. And thank you everyone of you presenters. This was a great deal of amazing information. And now we transition into the panel portion of this one summit super session on intelligent networking. Now we turn to our panel and I'd like to introduce our panelists. We have Lingli Deng from China Mobile, Stephen Casey from Verizon and Beth Cohen also sometimes known as Machete Cohen from also from Verizon. Thank you panelists for taking time to be with us today and let's go on and kick off our interactive part of this super session. I'd like to start with what are the drivers behind wanting to look at intelligent networking are these more business or technical oriented and do you think it is the operational efficiency that we can achieve or is it making the network itself more intelligent. Lingli, could I ask you to kick off with your first answer to this first question. Sure. I think for our case the drivers are both and even more. So for China Mobile our business challenge the number one challenge is how to manage efficiently the largest mobile network in the world. We're serving almost one billion customers with five million base stations and for which operation and retainers we are hiring about 60,000 engineers and spending annually more than 20 billion US dollars in total. So to address this challenge our solution is to design and deploy a scale autonomous networks which drives the realization of end-to-end intelligent capabilities enabling the use of artificial intelligence within the closely controlled loops. Some of our use cases include intelligent 5G service assurance which reduces the network orders and increases the efficiency for abrasion and retainers and making our financial department very happy because we reduce the operation costs. And another one is optimized configuration management of 5G radio network and also automatic provisioning of enterprise network services which improves the coverage and making our customers both individual and enterprise customers satisfied. And in addition to that we also deploy AI driven energy efficiency which reduces the power consumption of our 5G base stations by almost 25% and that makes our network intelligence transformation really important because it actually contributing to save our planet. Right. So I'd like to add on to that so Verizon has a somewhat different challenge because not only do we have the wireless network but we also have the wire line network so we have a mix and a heterogeneous network that we're maintaining and of course we also have a global presence. So for us our challenges are certainly business challenges and operational challenges so we are looking for the intelligent networks to really address how the operations people are supported and get more efficiency out of the engineers that we use to maintain our networks but also of course use the networks more effectively and more efficiently. And I know Steve you probably have something to add to that. Yeah I would add on to that Beth I agree 100% with both of what you've said. There's also a complexity factor that we have to consider here as well. As our networks become more resilient and we have layered networks upon our networks it becomes more challenging to identify issues in the network and we find that AI ML helps us to narrow those points down without flooding our operations teams with too many messages that they can't use and focusing on the point where it needs to be solved and we see over time that this will have to become more and more integral to increase that overall customer experience by leveraging metrics more and more and applying it across different layers in the network itself. So what I am hearing is improved efficiency but also make internal operations folks happier improve customer experience and save the planet. That is what we're up to as we look at this transformation that's amazing related to going back to what we looked at in the presentation the EU AG just did this survey and what I'm interested in is not the sort of obvious results but what was most surprising to you that you found out through this survey activity. Steve could I ask you to start there? Sure, I'd be happy to Heather. What actually surprised me is if you look at the numbers and you look at the results one way you can say is there's not as much AI going on as you expected and especially in some of the areas like autonomous networks and things like that but I actually found it interesting to say 20% said they were fully autonomous or highly autonomous. That number actually surprised me because given the fact that it's challenging to get to the data it's challenging to find AI ML resources that can work on the data and it's challenging to process that the operations team through automations and systems like that can actually set up true autonomy that they were that far along. So it was pleasing to see that actually the 20% seems small but in my viewpoint that's actually further along than I expected because we hear the buzz about AI all the time and everybody's doing it but the reality is when you actually start looking into it and see who's doing this there's not as many people that are actually doing AI as we would expect and we hope to see that improve over time through a number of different projects and especially open source projects that can help to accelerate that. Yeah, Langley did you find anything surprising about the results of the survey and hearing the voice of your fellow operators? Yeah I would like to say what a coincidence What's the price as most is also what we found out with the road data and after we compare it with a more in-depth analysis is that we found out that the industry currently actually lacks a basic consensus on what is the intelligence transformation of the network or in other words the goal and the path of how to build an autonomous network despite the fact that many industry organizations and companies as I said have launched related work and also like operators China Mobile have also included autonomous network construction in our own five-year deployment plan but in fact through this survey we found that the interview is actually did not fully understand what the ultimate goal of network autonomy is and for example we found out that two interviewees said that their company's network autonomy level or intelligence level has already reached level 5 the ultimate goal for full autonomy but when we later combined their feedback with extra information about their application coverage or roll-out stages before we make the comprehensive judgments we found that at least one of them which represents 50% in total actually does not meet the standard for level 5 which states fulfilled or domain and universally capable of self evolution and we believe that this is a very good reflection which shows that there is actually no well-established industrial consensus of what it will look like or the ultimate goal for building network intelligence and in view of that we would like to address this issue because we have already included in our 5 year plan so to kick off the practical application in our production network we have to develop an implementation architecture and level based evaluation system which are specific to our own operation and retainer systems to guide the transformation of our network operation retainers transformation in all of our 31 subsidiaries in mainland China and we introduce autonomous capabilities at different levels of the network operation and management system and conduct evaluation one or two times annually to trigger a iterative evolution and the result for the very first duration which is partially down and the first half of this year is quite encouraging and at the same time we are fully aware that there is still a long way to go for reaching the level 4 go for our network and we firmly believe that only by joint efforts with the industry that we can actually continue this journey so we summarized and published our thinking practices as well as corporations adjustments and the white paper in July this year and further contributed the generalized methodology which we believe would be also applicable to other service providers and also our industrial partners for their references in the form of technical specifications to standards organizations including TM foreign, 3GPB I2T etc and that is what we have found out the most surprising to us and that is what we are react and tool it and trying to address it and I hope and it will also be of help to our yellow and service providers as well and very welcome other partners to join our practice in building advanced levels of autonomous networks together. So it sounds as though both you Lingley and Steve were both surprised by the combination of maybe self-reporting optimistic at a time when the consensus of achievement is still I guess itself under question Steve anything you have to add back into that or Beth do you want to jump in? I'm good on that one Heather I agree with what Lingley has said in that Yeah Alright then let me go to my next question which is we've talked about where people might be or might think they are in the journey and even what does this journey even look like getting started or moving along the path in the journey obviously there are going to be challenges so what do you see as the biggest obstacles which we need to overcome as an ecosystem? So I'd say there's two sets of challenges one is internal to specific companies and I'll talk a little bit about them in a minute but the other one is an industry-wide challenge as Lingley mentioned I don't think there's a consensus about what in fact intelligent networking even is and as we discovered from the survey many operators are focused on the operational aspects and less on the on the intelligent networking as in algorithms and automation so and those are really two different components you really need to address both internally many of our challenges have revolved around as a telecom rising in various forms has been around for over a hundred years and many of our operational systems are they're not a hundred years old but but they're not young not young and you can put all your lovely GUIs around the core data but at the end of the day it's very, very difficult to rebuild those data sets and so we have the sets of data that were built or designed 30, 40, 50 years ago and we're pulling the data out but it's not necessarily data that can be really applied in the way that you would expect for intelligent networking because things have changed over time so that's one challenge another challenge is of course Verizon is made up of a set of a number of companies that have been merged over the years and each one came with their own set of applications and data and OSS-BSS and OSS-BSS systems so that's a challenge in itself just crossing through those silos and I know Steve you've found some challenges as well related to algorithms and data sets Exactly, they're very diverse they're very different consistency would be very nice because most of your time is spent in data wrangling that you'll have I think we've found at least three to five different names for Jitter across the different data sets it would be really I need to pause you Jitter is named differently within a telecom networking's own data like data systems it's pretty sad isn't it Exactly because we have a number of different partners that we work with and everyone comes up with their own little twist so you have to take those twists and put them back into something meaningful so again you can layer that up and look through the network layers all the way from your physical layer all the way up through your virtual layers to your applications and that's the challenges is going across those because most of the time when somebody calls with a problem they're not saying I have a problem on my optical network they're saying my application is running slow and that's where you start at and then you start going through the layers to figure out what is really the problem Yeah so Lingli you were mentioning the size of China Mobile's network and your subsidiaries are you finding the same thing? Are there this many different words for Jitter? What challenges are you seeing out there in the world trying to do this? Right First of all I 100% agree with what Bas and Steve have just said data has always been a challenge for us and because data is actually to us is the fuel of artificial intelligence and we have tons of different data as you can imagine produced as a result of our OM system each day that without a unified data standards system established these data could hardly add value to the network intelligent platforms and another perspective regarding data's challenge is that we found there's also a lack of effective data governance solutions inside our network we have different management domains like technical domains and data does not flow freely among different domains among different administrative departments that for us is quite challenging because AI actually consumes data especially with the use case that Steve has just mentioned we need to leverage and to end data to diagnose what are actually the broken part of the end to end service link so data governance is also important for us to establish inside our system and aside from the data perspective we also find out environment is actually we believe the number one challenge for us is to do our intelligent R&D because our network is so complex it's highly dynamic well not flexible and the complex environment characteristics and its uncertainty actually provides extremely rich scenarios for us to do the network intelligent we see a potential like blue ocean but at the same time the complexity of the system or network and its danger also slows down the innovation in network intelligence innovation because we could not use the live production network environment to do the R&D applications because there has been great requirements for our services well the research and development AI technology actually require experimental feedback especially those involved in reinforcement learning and deep learning and things like that and also all the machine learning algorithms are actually iterate quickly if the actual data characteristics and changes in the production network which means that it has to be retrained and optimized in our cases on the one or two months basis so without environment for us to try new algorithms and its revision or models on the production network is the number one challenge for us to actually to do their algorithms and improve them and consistently and we believe that it is important for us to build an end to end experimental network environment and we are also committed to build that one at least inside China mobile's rim and open it up to our partners and even academia to try and help us to do more innovative experiments in that environment before we can actually deploy them in our production network after proper verification and I'd like to add so and I have experienced with other A.I. type activities in a previous life I did work on speech recognition which of course uses A.I. and there's a lot of bias that can get added into the algorithms unintentional bias and also a lot of black box thinking which is a big challenge because you really need to validate that those algorithms are actually working and not just magic pops out so that's an additional challenge that it sounds like you're addressing as well by having an experimental dataset to work with so that's a very key issue that I think the open source community can really address by creating that sort of standard dataset to work against that would be anonymized and not proprietary to each of the telecoms Yeah, I mean it's the complexity of the network and the complexity of the bias we don't even recognize inside our heads it sounds like our challenges and because I think both Lingley and Beth just sort of recognized how we start to deal with this complexity and how we deal with not being driven by our own bias because we're looking inward rather than outward brings me to open source and collaboration so we have some projects that we've gotten kicked off let's talk about how you as operators are contributing to those projects and also how you would like other operators and the entirety of our ecosystem to participate and what projects should we be considering also starting at the same time and how do we use open source to help us accelerate this and improve Steve I'll take this one, thanks Heather so if you look through the overall flow in the process of developing machine learning algorithms you have devices producing data in an intelligent in a non intelligent and an intelligent network you have data collection data preparation and then actually building the models and if you slice and dice those down and look at them really the first two components comprise about 80% of your work effort so it's the collection and the processing the last piece is really more minor is the modeling process we'd like to see that flipped around because the more we can reduce those first two pieces the faster we can get to the real piece that we want which is building models so we can have insights that will drive our business and make our customers experience better so our ask out to open source is to start looking at the collection phase of it to generate the log files today those are fine you know systems process those but can we make it easier to process those log files can we put those on a message bus at the same time so it's easy to pick up that data and start using it that's one of the main first components the second piece is data granularity data is data today from these devices anywhere to 15 increments to an hour or longer and the problem is in these large networks and complex networks a lot of things change in that time so a lot of things get missed in that signal if it's been aggregated down so we're asking go to lower levels of aggregation and if you can't even step down to raw where it makes sense so the actual symmetry coming off of the device so we can make it faster and quicker and richer and then finally the processing piece of it right we have this plethora of different devices that are producing data they all name things differently they put them in different formats they have different metrics in there can we take that and say let's put some standards around that and can we ask the open source community come up with common naming schemas come up with common practices for this data and publish what the data means I can't tell you the number of challenges I can't move through by getting a data set and then saying what does this metric mean doesn't having value how does it relate or we've got 12 different log files from this one device how do we put those back together into something meaningful if that's published that makes it much easier to get the data scientists going and not have to convert a data scientist into a network engineer as well because then they have to have that skill set to do that there's projects out there today like project and the data project which are great starting points but last also is to go out there and say on these other projects that are not related to make it easier for the teams by doing these things up front so we can expedite the process and make it simpler for everybody to get to quicker insights yeah what I really like too is how that sort of the challenges of getting data from devices that is a little it's too aggregated and not quite fast enough combined with what Lingley you were saying about getting the data into the deep learning systems to train them on something faster than a month basis right it's we need more data more quickly and more continuously and so Lingley hearing both you and Steven talk about data and its timing together do you have something to add and also in the context of how open source can help right as I said earlier we see that it is an urgent need to build an open innovative experiment to environment for intelligent networks R&D and providing the basic infrastructure testing environment data sets and also providing input for a generalized intelligent platform which actually provides the whole lifecycle management for all the network intelligent applications and it is also reflected in the EU AG survey that actually the more advanced stages of the interviewees enter into network intelligence transformation there are more of them actually adopting the unified intelligent platform approach and for us we are actually building the intelligent network platform based on ONEP and also Kubernetes and several other open source projects and we are also integrating with more advanced ML ops from other open source communities and as you could imagine we also have an open source infrastructure for the network 5G network based on open air interface and also some of our other open source toolings so open source are of much importance for us to build the environment for the testing for the innovation and we also believe that some of the testing and certification program or efforts inside AFN could also be helpful for us to identify or broaden our view in potential potential intelligent application providers so for us especially for OAN we have a very restricted suppliers you know chain and it is also challenging for us to introduce advanced AI technologies because those suppliers for our OSS systems are not that capable of doing artificial intelligence especially algorithms innovation as you can imagine so if we would like to also leverage the industry and identify more potential collaboration partners and open certification programs that would be also of wider help for us to get our go I believe I agree with that as well I know that we are working on creating the Anakid Assured program which of course is tied into infrastructure and not specific to AI but it will certainly help go a long way and I think I want to put out a call to action to the vendors to support this as well I know as what came out of the survey is the vendors are actually looking at AI as well but I think that they are not as far along as the telecoms if I remember from our analysis and of course another thing to remember is that as I said earlier there are two types of AI here that are by specific to the technology of the network which in production you want it to be in minutes you don't want it in two months and but also there is the applying to the operational aspects of it so I know that we are doing some work around natural language processing and other types of things that aren't specific to the network but are still moving along with the design of improving our efficiency in the operational aspects of running a very large network All right is there anything else that any of you would like to add to this conversation before we do our panel Lingli, yes Yes, just I think it's about also what Beth has just said so our current practice has been most focused on the operation layer but in the whole picture we envision that there will be four layers of network intelligence the network element layer the domain specific management layer the end-to-end operation layer and on the top of that is the business operation layer which actually enables our industry or customers and also expose the network management capabilities if they wish they could control and do self-service as well and we start at the operation layer which is the middle two layers but we expect to achieve the ultimate goal at least for level three or four we have to also look at what would be needed to be added to the bottom layer the network infrastructure as well as the top layer how we could enable and expose those capabilities to our customers and we believe that there needs to be a consistent systematic design to align different technical evolution standards between different layers because ultimately we would like to enable a vertical closed loop which actually triggers by the customer on the top and triggers in internal like closed loops at their underlying layers iteratively and that would be the ultimate goal and for that case we are actually also working with multiple standards development organizations that are typically working on different layers and there is currently none of them are actually working on all the four layers so we have to indeed leverage in what I think that could also only be done by CSPs working together to drive a multi-STO collaboration which is not the loosely collaborative model as it is now we really need a traditionally federated collaboration model between these different organizations and in addition to the document driven standards specification development I think open source as the format of learning code would be having the specific advantages in enabling the interoperabilities that would be quite essential to enable that vertical collaboration Alright Mr. Casey I think I'm going to leave you with the opportunity for the last word here Thank you I appreciate that Heather so I would say in tying into what Beth and Ling Lee have said we look at this as a network intelligence of kind of in two different pieces and this is kind of reflecting what Ling Lee said also earlier and that is that you have the intelligence of the network taking care of itself and making sure it's better for self-provisioning, self-help all those things that keep the network and make it go stronger and better for the customers but we also look at it from the application intelligence view as well and that's the downward view on this and that is what does the application need and how do we share that information back with the network so it's not just the network taking care of itself but it's taking care of the needs of the application which then takes care of the needs of the user and we need to look at both sides of the application because it's easy to start with saying hey make the network better but it's also make the network better for the applications and change that over time based upon what the needs are so if users showing up you change the network so that it supports their needs and the applications are running as they are not working as much the network can change and do other functions that it needs to perform and make this dynamic fluid type in the ML to build that intelligence for it and let me add and it should be transport agnostic i.e. be able to incorporate wireless wire line and other technologies seamlessly so that the customer doesn't necessarily know what network the packets are actually going over as long as it delivers the experience is it over glass is it still over twisted copper pair it shouldn't matter to the customer yeah and at the end of the day I mean I love what you were saying Steve that it's making the network more intelligent to better serve the needs of the humans using the applications and I think that that is a great place to end I want to thank each of you for joining us on this panel today I want to thank again China Mobile for the presentation that preceded this panel and I want to thank everyone out there in open networking land who has tuned in on our virtual one summit and chosen to take in all of this great information so thank you to everyone out there this concludes our super session on intelligent networking AI and ML for one summit 2021 wishing best of health and good living to everyone who's with us today


Gwyd moren nhw. The first item of business is general questions. Question number one has been withdrawn. Question number two, Douglas Lumsden. Thank you, Presiding Officer. To ask the Scottish Government what measures it has in place to ensure that there is full transparency when it comes to the use of public money? Minister Tom Arthur. The Scottish Government is committed to a transparent Scottish budget and has robust controls in place for improving financial expenditure and investment. We can fly with all Scottish Parliament and Audit Scotland Financial reporting and auditing requirements, providing unqualified accounts since 2007, and work with parliament and its communities to improve budget scrutiny. The Scottish budget and NEN year-end revisions are scrutinised by the Parliament, with the minimum of two budget updates being published each year. To support and improve transparency, significantly enhanced budget revision information is ond rwyf am y cymdeithasig a'r committee o'r ffordd gan Ffain adm yn ddau. Douglas Lomson Felly, mae gennym iawn llwg hwn, a leoedd o'r vaff ymddir y gallwn Cymru, ac wedi'n dechrau yn ddylch i chi'n gwneud, oherwydd i'r grwyffr yn ddaskunu i'r grwmpia Thank You Diw? Felly, ar gyfer dechrau i'n ddullion hwnnw, mae'n dd mythoio i'r ddydd ar gyfer y sector a'r grwp datblygu i bod i'r gwsihfau, gwybod a'r ffordd a'r ei ddweud. Natural portrayed erfawr. Felly ddoddai'n ddatblygu i chi ymddir iaith a gallu ddalaeth y dyfodol yn cyd-plodol? Mae, o ddysgu i chi'n ddiddordeb gyda'n ddowr, yn y cymdeithasol, mae'n ddoddaghfeydd. Felly ddoddai'n ddoddiaeth iddyn nhw, yn rwynt o bwrdd, ei chael mwywg, mae'n ddodd, mae'n ddodd i ddodd yn gynfer ffordd. Rwy'n gynlluniaid i chi'n ddodd ar gyfer cyfos Whewcawyr. Of course, in government we are committed to, as are all public bodies, the highest standards. On the specific points that the member raises, I am happy to come back to him in writing on the specific details of those points. As I said in regards to my original question, we are committed to the high standards of transparency and all matters pertaining to the use of public money. Does the minister agree that it really is farcical for a member of the Conservative party to stand up in any chamber in these islands and ask about transparency relating to the use of public money when his London bosses wasted billions during Covid and hand out payages for donations? I think that the member makes a very important point and I think that fundamentally what there is with the Conservatives and its unsurprising is a complete lack of self-awareness. If one is a member of a party that has inflicted austerity upon so many people, if one is a member of a party that inflicts the rape clause on so many people, if one is a party that takes an appalling policy towards migrants and small boats, then perhaps a lack of self-awareness and a detachment from reality is the only way one can live with oneself. Before I move on to the next question, I would say to the member who has just put that question to please in future bear in mind the need for matters to relate to those for which the Scottish Government is general responsibility. The truth is that both Governments operate on the basis of appearing to be secretive and lacking in transparency. Papers from NHS Highlands suggest that there is a projected overspend of £1 billion in the Scottish Government's health budget but ministers remain in a state of denial. The lack of transparency makes it difficult to follow that movement of money, so will the minister publish a detailed financial explanation of how those pressures have arisen and what action will be taken? I stood in Parliament last week and reported on the provisional outturn. I have appeared on numerous times before the Finance and Public Administration Committee on budget revision matters and indeed we do publish full consolidated accounts that have received unqualified audits for every year that we have had an SNP-led Government in Scotland. We provide an abundance of information to ensure the utmost transparency on matters of public finance. Of course, as I have said previously, I am committed to continued engagement with the Finance and Public Administration Committee and any member who happens to be interested in those matters to ensure that we can improve and enhance the transparency of public finances in Scotland. To ask the Scottish Government whether it will provide an update on the visual recorded interviews pilot, which involves Police Scotland, recording the witness statements of adult and 16 and 17-year-old complainers involving allegations of rape and attempted rape, including any learning from the cases involved as they progressed through the court system. This two-year pilot, funded by the Scottish Government, concluded in May 2022. Where appropriate, the aim of the pilot is for the Crown Office and the Procurator Fiscal Service to use these interviews as a complainer's evidence should the case proceed to trial and to make an associated application to facilitate the cross-examination of the complainer by means of an evidence by commissioner hearing. We are carrying out an interim review of the pilot, and when sufficient numbers of cases involved from the pilot progress to trial, we will complete a full and meaningful evaluation. I think that everyone would probably agree that there are very clear benefits to complainers in not being retraumatised by the continual retelling of their story over and over and over again. For those who might be interested in this, it is illustrated very well by the TV True Crime series Unbelievable, which shows both the compassionate and the not-so-compassionate treatment of victims of these types of crimes. The type of video recorded evidence is now standard in many other jurisdictions. I am pleased to see that the minister is saying that there will be an interim report on the progress. I would be very keen to know what the timetable for that interim report would be and also what the progress is on the potential roll-out of this policy across the rest of the country, because it is a key part of improving both evidence gathering and lessening the impact on victims. I am in complete agreement with the member. Since only a small number of cases have progressed to trial to date, it is too early for an evaluation to make meaningful assessment. Therefore, it has been agreed that the justice analytical services would undertake an interim review of the pilot. While the pilot has formally concluded, VRIs still operate within the areas that form part of the pilot approach, with training continuing to be rolled out by Police Scotland. An internal evaluation of the pilot has been undertaken and will be signed off once the assessment has been completed by COPFS. I will get back to the member on the time scales. Very grateful, Presiding Officer, to ask the Scottish Government what support it will give in the academic year 2023-24 for the rights-respecting school awards programme. In May 2022, the Scottish Government awarded the UNICEF UK a three-year grant to offer their rights-respecting school award to all state, primary, secondary and special education needs schools in Scotland. During this period, the costs of participating in the programme are met at a national level rather than by individual schools or local authorities. That has removed local financial barriers to participation and secured an offer for all schools with significant public sector efficiency savings. In the financial year 2023-24, UNICEF UK will receive £300,000 from the Scottish Government for this purpose. I am very grateful to the minister for that answer. It is right to say that this scheme has reached out to 57 per cent of schools and 563 of our institutions have both silver or gold stage awards. It is right to say that registration will remain free until March 2025. However, some of the lesson plans and equipment that are needed come at a cost of £175 and more, which need to be met by the school themselves. Understanding their rights is fundamental to a child in Scotland understanding their place here. Would the minister agree with me that the learning of these rights is somewhat challenged by the position with regard to the UNCRC Bill, on which it is unable to pursue some of its rights? When will we see a change in this? Myself and colleagues have affirmed our commitment to the UNCRC Bill on multiple occasions. The delay to the UNCRC Bill should need not and should not prevent schools from building that rights respecting culture. As well as the rights respecting school award, we are aware of other great practice under way in schools, including through the Dignity and Schools programme, which is delivered by the children's parliament. Education Scotland has also developed a professional learning module that aims to raise awareness and develops knowledge and understanding of the UNCRC. It helps establishments to self-evaluate their practice in light of the UNCRC and supports improvement planning within establishments. To ask the Scottish Government what its position is on whether child mining development officers have a significant role to play in supporting and assisting child miners in their professional development. The Scottish Government recognises and values the unique role that child miners play in delivering early learning in childcare to families across Scotland and is, of course, keen to see our child miners supported in their professional capacity. Therefore, it is supportive of any additional support and assistance that is made available to our ELC professionals at local levels to aid their professional development. Christine Grahame, I thank the minister for her answer and I share her views on the valuable contributions of child miners. I refer to written answer S6W-191560, me dated 21 June this year, advising that Scottish Borders currently has a child mining development officer contracted through the Scottish Child Mining Association to Scottish Borders Council. Unfortunately, local child miners have advised me that this position is not to be renewed, which causes them and me concern. Does the minister agree? As the child-binding development officers or SCMA employees contracted to work with local authorities, any employment or contracting decisions regarding those roles would be a matter for the relevant local authority and SCMA to determine. However, child miners are such a hugely valued part of our ELC sector, and I would encourage local authorities as commissioners of services to continually consider what support is available for them at local level. For that part, the Scottish Government is working very closely with SCMA to promote child mining. We have supported a successful childminder recruitment pilot aiming to recruit and train 100 new childminders in remote and rural communities, with a second face now trialling the recruitment model in urban communities. We are also piloting activity with SCMA across six local authorities to support childminders with streamlining, and, therefore, reducing the administrative burdens associated with our practice. We will continue to work with sector representatives. The problem is in professional development. It is trying to encourage people to enter and stay within the childcare profession. The Scottish Child Minding Association said that 34 per cent of childminders had quits since funding was increased for early education and childcare in 2016. By 2026, the figure is expected to have risen to 64 per cent. I know that the minister shares my passion in early years, so can I ask her whether she will update Parliament on any progress that her Government has made to tackle those worrying statistics? I thank the member for that question. The Scottish Government is working to increase the number of childminders operating across Scotland. That work includes supporting the innovative SCMA-led Scottish rural childminding partnership recruitment model and its extension into urban areas. The pilot offers a package of fully funded support and training available to successful applicants, providing everything that is needed to establish a new child binding business from home. As I have said, childminders are a hugely valuable part of our ELC sector, not only in their involvement in funded ELC, but they will have an absolutely vital role to play as we deliver our programme for government commitments to extend funded early learning and build that system of school-aged childcare. We will continue to work with the SCMA, other sector representatives and statutory bodies to address the issues that are affecting recruitment and retention, including reducing administrative burdens. Is the loss of funding for the SCMA's childminding support officer in the Scottish borders not only deeply regrettable, but is it not also an example of SNP council cuts? Will the minister therefore now agree to look again at the support that he gives councils to discharge their 1140-hours plan, both through childminding and nursery provision? I have been clear in terms of my support for this. Childminders, as I have said, are such a hugely valuable part of our ELC sector and I am always happy to consider any proposals that would aid the delivery of the Scottish Government's policy on early learning and childcare. However, the posts that the member referred to support delivery within local areas and I would want to see local authorities as commissioners of services consider priority in their areas in the first instance. Question 6 is not lodged. Question 7, Clare Baker. Thank you. To ask the Scottish Government how it is promoting and encouraging an increase in employee-owned and cooperative models of businesses as part of a shift to a well-being economy. Thank you, Presiding Officer. I must first declare an interest as a cooperative member myself. As we approach tomorrow's Employee Ownership Day, I thank Clare Baker for highlighting the importance of Scotland's thriving cooperative and employee-owned businesses, co-operatives and inclusive business models. They play a critical role in economic recovery, supporting the Scottish Government's aim to create a fairer, stronger and more democratic wellbeing economy. Cooperative Development Scotland, funded through Scottish Enterprise, continues to work to raise awareness of the value of co-operative and employee ownership models and provides specialist advice and support to businesses and community groups who want to adopt those models. I thank the cabinet secretary for that response. In March 2022, there were 109 to five employee-owned businesses operating in Scotland, compared with around 100 in 2018. At that pace, it will take at least another 12 years to meet the target of 500, rather than the seven years that the Government has left to meet the 2030 deadline. I ask the cabinet secretary if he could provide an update on the review of how to significantly increase employee-owned businesses that they committed to in the programme for government and what related action is going to take place in this year to kick-start the significant increase that we all want to see. Yes, I am happy to. As we set out in the national strategy for economic transformation and the programme for government in 2022-23, Clare Baker refers to, a review will be conducted of how to support Scotland's social enterprise, co-operative and employee-owned business sectors to grow. The review will commence in autumn this year with an initial pre-review stakeholder discussion to be held this month. This initial meeting will be chaired by my colleague the Minister for Community Wealth and Public Finance. Ivan McKee As the cabinet secretary has rightly identified tomorrow, it is employee ownership day by thousands of employee owners, employee-owned businesses and supporters of employee ownership from across Scotland and the UK come together to raise awareness of the benefits and impact of employee-owned businesses. I have been delighted this week to host in the Parliament an exhibition by Scotland for Employee Ownership, Corporate Development Scotland, Scottish Enterprise and the Employee Ownership Association. In the garden lobby, I commend members to visit that stand. I would like to ask the cabinet secretary what the Scottish Government is doing to celebrate and promote employee ownership day. Ivan McKee for supporting this week's exhibition, the work he did in his previous role to support this sector and joining him in commending to all members. The Minister for Community Wealth, Building and Public Finance, Tom Arthur, is co-chair of Scotland for Employee Ownership. He met yesterday with fellow board members, including the Employee Ownership Association, as well as supporting this week's exhibition, the board discussed plans for further events later in the year. To ask the Scottish Government what assessment it has made of whether its target for a one-third reduction in food waste by 2025 will be met. The Scottish Government's commitment to reduce food waste will deliver waste reduction while maximising carbon savings. Based on robust waste compositional analysis, we aim to publish an estimate on food waste levels in Scotland in the coming months. That will help inform our understanding on progress against our 2025 target. We will also inform proposals on the upcoming waste route map and refreshed food waste reduction action plan, both due for publication this year. I thank the minister for that answer. Earlier this week, the cabinet secretary was unable to say how much the average food waste reduction has been each year since 2016 when the target was set. It needs to be approximately 33,000 tonnes per year when setting the target, the Scottish Government would clearly know that. Can the minister tell the figure to the chamber today? I would say that one of the reports that gives an indication of our achievements in reducing food waste is the Scottish waste from all sources report from SIPA, which reported that food waste has fallen to record low levels. However, the Scottish Government is committed to improving consistency of food waste data to better inform our reduction efforts. The cyber attack on SIPA in 2020 has significantly impacted on food waste recycling data collection. Secondly, obtaining frequent accurate food waste data takes time and can be expensive, so we are working to secure accurate food waste data through obtaining a waste compositional analysis led to zero waste Scotland in SIPA. That analysis will inform the food waste reduction action plan review, which is due this year. I have a brief pause before we move on to the next item of business.


Yeah, we on Boss Talk 101. Let me ask you this about the documentary. I seen you, me and my wife, when Supreme, he invited us over and we watched the documentary. OK, OK. And you did a splendid job, man.  And some pictures and stuff. You kept going through all of these different people. The whole show had seemed, didn't it? And I kept seeing OG Percy just kept on. He kept on telling us about all these different incidents, man. For you to be able to go through all of that, it had to be. What did it build inside of you? A monster, greatness, strong belief in God. Yeah. You know what I'm saying? A spiritual. I'm saying a spiritual war for a lot of demons going through it. You know what I'm saying? Well, God took away a lot of that from me. You did what I'm saying? But going through all that, horrifying. But you know, I know if y'all kept up with me, I lost my brother a couple of weeks ago. I've seen that. Sorry to hear that. But I didn't lose him. He was murdered. He told me it's a different story. Good man. Not expected man. It's like y'all going out there and finding him, sitting in the car. No, he went even in that type of lifestyle. Yeah. Different, different feeling. Everything in that box didn't mean nothing to me until I've seen it happen to my brother. But in cases like that, I would always feel like if you have God, that's the time you hold on to him more. Well, you know, you would say that. But you know, you would say that, you know what I'm saying? Till that shoe was on that foot. And then you would question God. Why? For a minute. It didn't last long. But you'd see a little. I had to. I had to go there with him. For a minute. Come on now. Come on. Now I got this. Um. It hurts me to see somebody good go out so hard. I like to see the heart go out hard.   Don't go out. Come on, God. God dang, God. Yeah. Well, part of the game is that. Um. My brother ain't the only one. He showed me another picture of an old lady that was good in the community. She lived, worked good, fed everybody. Had a house in the back.  Some youngsters went to the house and beat her to death with a hammer. Hmm. How old was she? 96 years old. And made me say, come on now, God. You hear me? I definitely hear you. That's how I felt about my brother. Good man. Went to work every day, took her as kids. His family, his whole children. Had to sit there and watch their daddy like that. You hear me? I never did nothing. He was out for his birthday.  Good man. Good hard work. He took her as mama. Loved his mama. Took her as family. Took her every bill she needed. Paid from the phone bill to rent to everything. Make sure she had that. That's gone now. Good man gone. Wow. And that's, and yeah, brother, man. I don't even know what I'd do if I lost my brothers. Either one of them. But you know what? The only thing that comes to my mind. I see the same thing. Yeah. Believe me. But we are here just for a season, no matter how we go. Right? Life is not promised. Anyone of us can go any day.  Because your life is not your own. You're supposed to impact others.  But you remember at the court case how the brother went up to her and gave her that hug. And you, everybody was looking at him like, you crazy. Like, how could you forgive her after she did something like that?  I had to forgive. You did what I'm saying, I had to forgive when I didn't want to. But I had to because of the lifestyle I'm into now. You did what I'm saying, I can, you know, when you don't know who you're dealing with, the principal palestines, when you don't know them and they come towards you and you got to really deal with them. Now, I'm in the place where I have to really deal with them.  I'm in a place if I do do something, I'm into something now. I came forward now, one of them. Did what I'm saying? And I'm in a point where I didn't do so much for the niggas in the hood and then roll for this nigga and roll for this nigga and then come on person, let's go, come on, let's, and I'm nervous. Man, it's time for me to be there for my own and I came because of the life that I chose to live now. This is the season I have to make. So I got to forgive, only let God do his job. So when you forgive, this is not for the other person. It's not always for the other person, it's for you. Oh yeah, I need peace of mind. Definitely. I'm traumatized. Mm-hmm. Yeah, that's the most horrifying thing to see my brother laying in there like that. Yeah. Good man. With all the things that you've seen in your life, cause you've seen so many horrific things, how do you use that to help others? I tell them about it. God gave me the wisdom and the knowledge to keep my mind. You know what I'm saying? Even though I wasn't educated in the books, I'm educated in the streets. I'm a scholar in the streets. I run circles around a negative and went to Howard University. Already. You know what I'm saying? We're just common since they God gave me. Yeah. And I learned that that's the best sense. I agree. You hear me? The best sense. You can't beat me like that. I 100% agree with that. You hear me? I don't have to know what they know. I don't have to know what they know. God say you know more in my world. Yeah. Maybe you pull down here, but you rich up there. Already. I said, well God, I need just, you know, drop me a little chain. Yeah, we on boss talk one on one.


I was scared when I first saw him. It happened just as he told me. The messages, the pictures, seeing him around every corner afterwards. I was so young, who wouldn't have lost it? William sighed. But then he was over the creature following him. It wasn't like it was going to go away, no matter how much he begged or pleaded or attempted to bribe. He knew that the best and only solution would be to just get used to Capone being there. At least he had the solace of knowing he wasn't going insane. Believe me, William. I know many people have reacted the same way. Fear is a more common reaction to the unknown that you'd think. Dr. Laura Brains can solve them. These cases weren't exactly common, but they were commonly known. It's not even that I'm afraid of him anymore. I mean, he makes me jump when I see him in the morning. I don't think I'll ever get used to that. It's just the bad connotations he has. William rebutted.


Most modern cryptographic systems require us to find a very high power of a very large number And so we might be multiplying or might need to multiply a number by itself trillions and trillions and trillions of times and This is going to take a huge amount of time to try and implement and so one way we can get around that is by using something called the fast powering algorithm and In general the idea is that I can evaluate the expression of the form a to power m mod n In the following way what I can do first of all is I can evaluate a squared a to the fourth a to the eight and in general a to power 2k mod n for all 2k that are less than the exponent that we're interested in and Then what I can do is I can construct a to the m as a product of factors of this form And then I'll multiply these and reduce mod n now One of the reasons that this is useful is that these successive powers of a are formed by taking one of these and Squaring and taking one of these and squaring and every time we square a number We double the exponents or exponents are all going to be powers of two and this innovative algorithm was invented around 200 BC in a slightly different context in India and that's a story for another day But let's go ahead and take an example here We want to find 2 to 3 to power 35 mod 37 So what I'm going to do is I'm going to evaluate 3 to power 2 to the k for any value of 2k that's less than 35 So let's start out. We'll find 3 is congruent to 3. Well, that's unexciting 3 to the second power 3 squared is congruent to 9 3 to the fourth is the preceding value squared So that's 3 squared squared. That's 9 squared. That's 81 and here's the important point If I don't reduce this this is more than the modulus if I don't reduce this I'm losing all of the good things I have with modulo arithmetic So I really want to reduce this so I have to the ability to work with smaller numbers So instead of working with 81. I'll knock that down mod 37 down to 7 and note that in my next step I'll need to square this it's much easier to square 7 than it would have been to square 81 So next step 3 to the 8th. That's the previous one squared. That's 7 squared. That's 49 Knockdown mod 37 to 12 and again 3 to the 16 12 squared 144 knockdown mod 37 down to 33 3 to the 32nd 3 to the 16 squared 33 squared 1089 knockdown to 16 and at this point if I go any further I will get 3 to the 64th, but I only need 3 to the 35 So I'm done with the as it were data collection step now What I want to do is I want to find 3 to power 35 So I'm going to select the factors whose product will give me 3 to power 35 And this is just if the term means anything to you finding the binary representation of 35 And I can do that by selecting let's see I need this one so we'll take the largest value that we need we need 3 to the 32nd We don't need the 3 to the 16 that gets too much 3 to the 8 Don't need that one if I multiply these to you together. I get too much 3 to the 40th So I'll get rid of that one 3 to the 4th still too much That would give us 3 to the 36 get rid of that. I do need this one That's 3 to the 34th and one more is 3 to the 35 So I'll multiply those three terms together That's 3 by 9 by 16 and after all the dust settles 432 knock it down mod 37 And collect the exponents 3 to power 35 congruent to 25 Well, let's take a look at another example. We want to find 4 to power 50 mod 19 Now remember that one of the nice things about working mod anything is that you never have to work with a number Larger than or even equal to the modulus you can always work with smaller numbers if we don't mind working with negative numbers We can cut that down still farther and the largest number We'll have to work with is half the size of the modulus So for example here for congruent to 4 mod 19 for squared congruent to 16 And I could work with 16, but I also note that this is actually 3 less than the modulus So instead I could work with negative 3 much smaller nicer number to work with 4 to the 4th 4 squared squared. That's negative 3 squared. That's 9 That's 81 and again. I can work with a knock that down by the modulus 4 to the 16th 5 squared 25 down to 6 4 to the 32nd 4 to the 16th squared 6 squared 36 and again this time I'll knock that down to negative 2 rather than the corresponding value 17 and again this way I can work with even smaller numbers if I should want to Now as human beings, this is important as computers It might not be quite as important to do so, but I'll pick the values that give me 4 to the 50th That's 4 to the 32nd 4 to the 16th 4 squared multiply them together. There's 4 to the 32nd 4 to the 16th 4 squared over the left-hand side I have power 50 over the right-hand side I have product negative 2 6 and negative 3 gives me 36 Knock it down mod 19 down to 17 and there's my final answer


We wrote a book. We wrote a book about all the security assessment activities we are doing, what are the things that is covered in these activities, and how you can get some goodness. So let's dive into it. I mean, what a wonderful world today, isn't it? At least for the last two days, I've heard and listened and been part of so many activities, and it's so overwhelming. Everything is connected and there's innovation everywhere. I think it's the best time to be here around and be here in Silicon Valley. That's so awesome. This is not Silicon Valley. I understand San Jose and San Francisco and these times are. But I just came from India, so please bear with me. But in the same context, there are also a lot of things connected, and the attack surface is increasing more than ever. And that means if anything is, in fact, indeed kind of compromised, then all of us are in soap. And Lock 4j, for that matter, was a really good example to show that if everything is connected and if everything is, in fact, the way it is, we need to be really careful about what we are doing in the first place. And it is important to understand how secure are we really are. And memes kind of like this kind of make me scared most of the time. And it says that if any project is not looking into security in the first place, and they just build and look into their features and ship something, and then see, oh my god, how did we get hacked? That kind of makes me really, really weird and scared for the rest of my life. So that's one of the reasons why I joined tax security, because you're not alone in this process. There is a lot of help available for you. There is a lot of help in terms of what you should be doing and how you can actually do them in terms of tools and mappings and guidelines and everything. And there is also help to see if you've done it the right way. We also have a particular team of volunteers to actually help you go through the security assessment in terms of self-assessment, joint reviews, and things like that. And shout out to one of my colleagues and volunteers here. Shlomo is giving a talk in about 45 minutes. So please feel free to go to that talk and see all the goodness that we are providing as part of tax security. But then we also thought, how can we actually supplement all these goodness? How can we help you verify what you did was, in fact, right? And how can we help you verify at the earliest what you did or what you're going to do is indeed right? And that's where we want to introduce you to Security Assessment's book. Security Assessment's book is intended for project maintainers and security enthusiasts, security reviewers who want to join us in this process, understand what is going in the background, and we want to make sure we really lower the barrier for entry so all of us are in this together. If you want to perform some security review for your project, or if you want to join hands with us and join hands in this activity of assessment, it's really clear what is happening in the background, and we can all be together in this and improve the security posture of our landscape. And the benefit really is to understand the security assessment process and the benefit that you get as part of making the software itself more secure. And it started as part of, like Andy said, it started as part of a part of lightweight threat modeling because we had a very good process. But there were certain experts who knew what they need to be done. And if I wanted to join, I'm a student right now. I did a bit of my engineering and enterprise experiences before, but I'm a student right now. If I want to join, how do I really get started? Who tells me what I need to do? And that was not very transparent before, and that was primary reason why we started this project. So all of us get a clear visibility of what is happening and what needs to be done. And kudos to our primary author, Justin Kappos. He couldn't be here with us today, but he is wishing us the best from China. So thank you, Justin. And we want to make this a community resource. We're looking for feedback from all of you in terms of what you need. And if we are addressing everything you need, and if there is any scope for improvement, do feel free to reach out to us. Now, let's delve into what all the goodness is all about. So I'll be talking about the security assessment, how it is different from audit, how to perform one such thing. And if you don't want to perform yourself, we have volunteers who do that for you, how to get one security assessment for yourself. And what's next in terms of this project. So security assessment is about examining the architecture and the posture of your project. It's to give a holistic view on what are the things that you are doing and is it actually aligning with the goals of security in terms of your project. It dives deep into the systemic and the design-related issues, not necessarily the implementation. And provided your architecture doesn't change drastically, it does stay for a longer time. It sounds more similar to audit's right, but then audit has fewer minor details that is what makes it different from assessment. So audit really looks into the implementation issues. It doesn't really, it does, but not specifically meant to look into a systemic or design-related issues. And audit provides you a snapshot of your security posture at that point in time with the addition of minor details and new lines of code, that posture may change as the project progresses. But security assessments on the other hand, it's meant to be valid for a longer duration until you really change your architecture or revamp your project as a whole. Now, how to actually perform a security assessment? To do that, you need to know what you're protecting. You need to know what your assets are. You need, and assets are something that brings value to you and you have control to do something. Now, say for example, I wanna create a website. I host it in some cloud provider. I use DNS, I use routing services, I use my ISP to actually route my traffic to the web server. In this, something that is of value to me and which I have in my control to actually do something about it is my web server and my web application. Other than that, I can change a few things but not necessarily dwell deep into how they are implemented and make changes over there. So understanding what our assets are and how they interact with each other is something really important. And assets need not be just intangible ones. It can be tangible ones as well. So differentiating what is that that is important for us and how they interact with each other in terms of data flow diagrams among many others, that becomes very important. Once you know what your assets are, understanding who the actors are that is associated with the asset is another secondary factor. So there are actors who increase the security posture of your asset and there are actors who try to decrease your security posture. And then there are also actors who supplement it based on their activities. It can enhance or it can decrease. So understanding who these actors are is kind of very important. Now, once you know your asset, once you know the actors, you need to also understand what are the goals for your system? Is it confidentiality? Is it integrity? Do you want it to be available all the time? What exactly is the goal for your system? Now, for example, governments may be very careful and they may be very conscious about protecting their information and making it very confidential. On the other hand, Facebook and Google and availability may be very important for them because even one hour of downtime or even one minute of downtime will bring a loss of huge amount of revenue for them. And these, the CIA tried, is considered the holy tried, but it's not necessarily enough. There is also other secondary factors, such as authentication, non-repudiation, secrecy, privacy, and other factors that may also be important for you. Understanding what these goals are is very essential. And with these goals, we will be able to map what are the things that are in threat and how we can actually mitigate it. Now, on the other hand, the attackers are very, very interested in bringing down all our goals. So they may be interested in disclosing our sensitive information, altering our assets and hampering our integrity and distracting our services and bringing down the availability. So understanding what the attacker goal may be and what is that your primary concern will help you in mitigating all the risks. Now, from the assessment perspective itself, there are three primary goals. In terms of assessment, you need to identify what your threats and risks are and then you need to categorize based on the impact and then respond based on what is that as most important for you. From the identification perspective, if you've been in the previous talk, you've heard in lengths and depths about this thing, there is several modules that is available and methodologies and frameworks that's available for you in terms of what actually is in threat for the service or the application. So basically, in terms of identification, we need to know what are the threats that is possible for the service and to know that we already went through the actors and assets that is important for us and among the various frameworks, Andy talked about stride, but there are also other things like pasta, tried and octave and linden that is newly available for privacy. So based on what approach your organization is taking, is it a risk-based approach? Is it attacker-centric? Is it developer-centric? You can choose the relevant model for your identification and then work upon the threats accordingly. So now in the cloud-native community, we are mostly developer-centric and we are very focused on our community and stride is one such developer-centric model that helps us identify the threats and help in the mitigation steps. So in this book, we talked more about stride framework. So stride basically stands for, it's an abbreviation for spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. So when we want to discover any threats that is applicable in our environment, it can be fitting into one of these buckets. So if there is no TLS, no encryption, then it is hampering our information disclosure and it's actually bringing down the confidentiality and things like that. So this is how we can identify what really matters for us and how threats are impacting our product. Now once we know what are the threats that is applicable here, we need to know what is the damage that is caused because we do not have forever, we cannot boil the whole ocean, we cannot address every little thing that comes upon us. We need to be able to find what is that is most craziest for us or what is that is most easiest for us? Because for some threats, stars need to align and some crazy four, five, 10 zero-day vulnerabilities has to come up for some threats to be realized. But for others, it's clearly visible. Some web application is running on HTTP, that's clearly a threat for us. So those are the ways in which we can identify the impact and the likelihood and then find out what are the damage that is caused for our service and mitigate it accordingly. And there are popular frameworks like common vulnerability scoring system and Dread from Microsoft that is available for us to see what is the impact and categorized based on that and address accordingly. Now once the impact of the threat is known, next step is to go for how we respond for those threats. Now we know there are high severity, medium severity or low severity threats and how we respond to those threats is very important in terms of if there is a possibility to prevent something, let's prevent it. Let's not put some patch and just make it something like immediate thing. Let's think about the long term and if there is a preventative measure, let's do that. But if there is no preventative measure that's available, at least let's recover from it. If there does happen some damage, let's recover from that damage. If that's also not possible, let's detect that some damage has happened and trace the whole source of it. If there's no traceability, at least let's detect it. Otherwise, at least let's do some traceability. So this is how the prioritization works. So we prevent it, if not possible, let's recover and if that's also not possible, let's at least detect with some traceability. So we did supplement, we wrote a big book about it to verify if what you did is right or how we can verify at the earliest what you're doing is right. Now this is already a process in tax security. We have a big process for all the projects that is going from sandbox to incubation or entering sandbox or you want to go to graduation. So what we recommend is first step as performing the self-assessment. So there is a lot of material that is available in our repository. You can go ahead and perform the self-assessment as per the template that is shared and present the details in one of our tag meetings. So tag technical advisory group for security. We meet every Wednesday and you can present it in any of our meetings and it's a community of security engineers. We are more than happy to review and share our feedback. And once you have completed the self-assessment and given the presentation, tag will include it in our repository and you can just create a PR and include the self-assessment and we're more than happy to include it in our repo. And once that is done, this is usually recommended for projects that are entering a sandbox to us and a bit lower in the maturity in the tag graduation process. And the next one is the joint assessment that is recommended for somebody who's going from sandbox to incubation or incubation to greater maturity of graduation. And in that, the volunteers from our tag sit together with you, understand the whole process of what exactly your application is doing and where the threats are coming from and what is the impact of each of these threats and how you can mitigate it to enhance your graduation level or maturity level. So to get one such assessment, you can initiate a joint review request. You can add an issue in our tag repository. All of the links are given here and the slides will be shared. So you can issue one such issue in our repository and we as reviewers, we sit together and see if there is a conflict of interest and we declare that conflict of interest and get together who are not having any such conflicts and then we sit together with the project teams and understand your project scope and what are the threats that is applicable and we clarify all the review process together. And in some cases, we also perform the hands-on reviews and finally, this is discussed with you and finally it'll be presented in one of our tag meetings and the assessment will be added to our repo. And I really need to mention a couple of names here. These are the folks who have done awesome work in tag security assessment, Justin Capos, Matthew Kisa and Romartin and other tag contributors who have really spent a lot of time in helping increase our posture and as a community. So that's really awesome. Now what's next? You know there's a book now. I literally walked, I talk too much now. So how can you get involved? So if you have any feedback, go through the book first. If you have any feedback, anything that is missing, anything that could be done differently or any major things, please feel free to let us know. We are more than happy to inculcate the feedback. And for folks who have already gone through this process, if you have any commentary, expert commentaries, or feedback you wanna include in that book, please feel free to reach out to us. We chat in the tag security assessment slack channel in the CNCF workspace. And we have come together a teeny bit of guidelines for engagement so that we accelerate this process and not stick together with small nitty gritties. So we try to focus as much on the high level of problems and omissions and we welcome any expert commentaries and feedbacks from the community. And to maintain the uniformity and single voice in the book, some of the modifications may be paraphrased by our primary author. So these are some of the requests for you in terms of guidelines for engagement. But other than that, feel free to reach out to us for any form of feedback. And with this, I end. Any questions? Thank you.