Hello and welcome to Dataversity Talks, a podcast where we discuss with industry leaders and experts how they have built their careers around data. I'm your host, Shannon Kemba, and today we're talking to Lauren Mifeo, a service designer at Steampunk, an author of a recently published book, Designing Data Governance from the Ground Up. With a robust catalog of courses offered on demand and industry-leading live online sessions throughout the year, the Dataversity Training Center is your launchpad for career success. Browse the complete catalog at training.datavercity.net and use code DBTOX for 20% off your purchase. Hello and welcome. My name is Shannon Kemba, and I'm the Chief Digital Officer at Dataversity, and this is my career in data at Dataversity Talks podcast, dedicated to learning from those who have careers in data management to understand how they got there and to be talking with people who help make those careers a little bit easier. To keep up to date in the latest in data management education, go to Dataversity.net forward slash subscribe. And today we are joined by Lauren Mifeo, a service designer at Steampunk, member of the editorial board of Springer AI and Ethics, adjunct lecture on interaction design at the George Washington University and author of the recently published book Designing Data Governance from the Crown Up. And normally this is where a podcast host would read a short bio of the guest, but in this podcast, your bio is what we're here to talk about. Lauren, hello and welcome. Hi, Shannon. Thanks so much for having me. I'm excited to be here. Likewise. So, so many titles. It's amazing. I love it. So let's start with service designer at Steampunk. What is Steampunk and what is it that you do there? Those are great questions. I get them a lot. Steampunk is a human-centered design firm serving the federal government. So we work on everything from Salesforce implementations and database interface redesigns to website migrations and service model implementations. So we work on technical projects for federal government agencies in the US, but we take a human-centered design approach to that, meaning that we try to have designers on every project to make sure that whatever we build is in service to real users of the products that we are building and redesigning. And so I am a service designer, which means that I am basically the user advocate on any team that I join. I'm responsible for everything from writing the research plan for the project to selecting which users I should interview. I'll host various types of workshops with clients and stakeholders to help them talk through their challenges and figure out how we can solve them. Once I've done my user interviews, I will create design assets ranging from personas to journey maps to service blueprints showing how users engage with products and services today versus how they might be able to do so more effectively in the future. And then ultimately I work with engineers and architects to figure out what we should build that's going to help solve those user challenges. Oh, very nice. So you're also a member of the editorial board at Springer's AI and Ethics and Adjunct Lecture on Interaction Design. So tell me about those two roles. Yeah, those are both fairly new. I joined the founding editorial board of AI and Ethics in the summer of 2020. So COVID was still raging and in-person networking was still impossible. And I saw that Springer was standing up a new peer reviewed editorial journal devoted to the academic study of AI and Ethics. And so I reached out and was able to join the founding editorial board. So my main role in that capacity involves reviewing manuscripts when authors submit new articles and op-eds to the journal. I'm part of the peer review process which reads the articles and evaluates them, gives feedback on whether they are ready for publication in the journal. And then on top of that, I also do teach a course in interaction design at the George Washington University here in DC where I live. And I'm part of the Corcoran College of Arts and Sciences here. I teach a course on interaction design for graduate students where we focus on really the human computer interaction part of design. So we really take the lens that tech is existing to do a particular job and it needs to do that job for particular types of users. And so we focus actually less on the mechanics of design in and of itself and more on how you can use user feedback and human centered approaches to really design solutions and products that meet very particular needs. My students are currently doing their capstone projects and we have about two more classes until the end of the semester when they will present their projects and portfolios. And I just started adjunct lecturing this past semester after wanting to do it for a few years. And it's been a really awesome addition to my work at Steampunk. And it's been great to help guide people at the graduate level through their design studies. That's amazing. I love that. So and you've recently published a book we'll get into what the why I think a little bit later but tell me about the book designing data governance from the ground up. Yeah, so I was inspired to write this book after working with some clients for several companies for several years, who were very intent on being tech savvy they heard all the hype about AI machine learning they wanted to use it in their own organizations. But the challenge that I first discovered in my prior role, when I was an analyst at Gartner was that most organizations today have very low levels of data maturity, which means that they don't have good habits when it comes to accounting for data quality. Many of them don't do data lineage tracking they don't have business glossaries which classify technical versus business metadata. All of this contributes to the fact that most machine learning algorithms once deployed are not successful and only 13%, about 13% reach production at all. So I saw very quickly that a lot of time money and human labor was being wasted on these non strategic initiatives that were just chasing the tech. And so then when I got to the design career that I have now I and I started working with clients more it more directly I quickly saw that many of them again lacked any automation, their processes took days to complete the integration involved two to three people that were doing this by hand, and that led me to realize that even when organizations exist to disseminate data, they often lack the backbone of a strong data governance program and framework to really account for the quality of data and then the reality is if you don't have that backbone of data governance established you won't be able to do any of the fun stuff when it comes to data. And that's the best case scenario the worst case scenario is that you could be involved in a data breach, you could not use PII masking when you're supposed to you could have duplicate data stored on several servers. And so that's where I got the idea to write this book, it is an intentionally short book it's a 100 page six step guide to getting your first data governance program off the ground. And it's short because there's a lot of nuance when we're talking about data governance depending on which software you use which cloud environment you're in. There are a lot of nuances to account for when it comes to what governance looks like for you, but the book does cover what, in my opinion, every organization should be doing at bare minimum to get their own data governance program up and running. I love that I love that it was born from issues, especially surrounding machine learning. We've heard so many companies run into the same problem they tried to stand it up but didn't have the quality processes in place. I didn't do enough user research and I do think I mean I'm biased as a designer in thinking that design should have a seat at the table in this process but I see so clearly how not accounting for user roles not not doing user interviews to figure out how people use different cloud environments not figuring out how to, you know, hook hook systems up properly and integrate them the right way. All of this contributes to technical environments that just don't serve their users they don't serve the people consuming the data outside of your organization but they also don't serve your primary users which in this case could be your colleagues who are tasked with using those environments and so I think taking a design thinking approach to data governance is very underutilized and I do think it's an important reshifting because data governance is often thought of purely as compliance or purely on the technical side of the house but the reality is that your culture determines which tech you use or not. And so I really think that reframing it as a design challenge and applying some principles there can reshift the conversation and make it more user friendly for everyone involved. Very nice. So, let's back up a bit. So, when you were very young in elementary school, was this the dream I, you know, I'm going to be at a service designer when I grow up. I'm going to write a book on data governance. I don't know. So I did not know what any of those words were until about maybe five years ago, a little longer than that but but I this is not a career that I think you grow up want knowing about and that's part of the reason I was really interested in this podcast at all is because I for the longest time didn't even know what a service designer is and I still to this day. I cannot say I'm a service designer without any getting the question oh what's that so because it's a very misunderstood role. It's very similar to either a product manager or a product designer depending on what the person does. I do tend to design digital services and so I'm more similar to a product designer that way, but I did not grow up wanting to be a service designer. However, I did grow up wanting to be a journalist and I really liked speaking to people and asking and figuring out what the right questions were to get the answers I needed.  And to make sure that those needs are included and accounted for in higher level conversations about what gets built. And so that is a job that I take very seriously and I am pretty convinced that journalism and a background in that is ideal training and service design, because I think the, for all the talk about being user centered. It's very easy depending on the context for user needs to get pushed by the wayside or deep prioritize my job is to make sure that that doesn't happen and so I do feel like I found another outlet to do what I enjoyed so much about journalism in that way that I did always writing a book I never thought that it was going to be on this particular subject, but I did want to do that and I think and I so the facts that I've been able to do it has been a real privilege and it's been really exciting. It's it's really something to get the book in your hands, once it's all said and done. So, you know, original goals morph, even though they've changed like from the time that your original dream right with of journalism, those dreams still get that that passion still gets built into what you eventually end up doing which is just fabulous. So you want to be a journalist. Is that what you just decided to study or how do you transition and tell me a bit about your career path. It was so I went into college very clear on wanting to pursue a journalism career I had already done a few internships in high school at local TV stations and I knew that I wanted to work in broadcasting. I always had a natural aptitude for an interest in writing and I was not math and science oriented, which is part of why it's very ironic that I ended up in tech working with data, because I did not I saw myself very much as a liberal arts student to the exclusion of stem subjects, I went to college in a large city with the intention of doing as many internships as I could and launching a career in new TV news. I did do some radio reporting in college and then when I went to graduate school and then completed graduate school, I did freelance journal, I what did work as a freelance journalist for a year. I worked as a I covered the tech and startup scene in Europe I had gone to graduate school in London, and I stayed for an extra year to launch my career and Europe's tech sector at the time was small but rapidly growing. So I was able to get in through some connections and I didn't care about which beat I covered I just wanted experience getting clips for my portfolio. I quickly realized that I was actually really interested in entrepreneurship and tech, and my job was not to know everything about it it was to find the people who did know a lot about it, and asked them the right questions so I quickly figured out that this was a subject that I was interested in. I also became a parent that the global news industry was not going to provide the stable career that I really felt like I needed it became a parent I was not going to be able to do very basic things like a 401k plan save for retirement, all of those things and so I had to do some serious soul searching earlier in my career to figure out if it was going to really be worth it, and then what I decided was to actually try joining the sector. So I went and joined a set Silicon Valley based startup as a marketing specialist, and then I transitioned to working as a research analyst at Gardner, which is a fortune 500 research and advisory firm focused on tech. And then I transitioned to steampunk so that's cut in a nutshell how I got from a to be, it is certainly not what I expected to do, but I have found the user research aspect of design to be a really fascinating fit and a great outlet for someone with a journalism background I still am adamant that we need journalists and great journalists more than ever, but, and I'm not opposed actually in my later years to maybe going back into that career if I have saved enough, but I think the fact that that's my attitude to the state of the industry today the fact that I would really need a solid nest egg to be able to afford to do that type of work and so there's that's a totally different conversation. I love the path I love the transition and and how you got into tech. It's it I agree it's I mean it's so important. I did a brief stint as a as a freelance writer myself so it's it's interesting work and I loved it's great work I loved doing it. I mean it was not about get not having passion for the work I was very interested in it, but it became clear very early on with the rates I was getting with the rate of work coming in it was just not going to be sustainable. And yes I could have moved to a much cheaper area because London's very expensive but that the reality is the supply of people who want to do those jobs far exceeded the demand and this was 10 years ago so and things are no better now they're only getting worse so. So tell me a little bit about your time at Gartner our community certainly is familiar with Gartner and and what they do so what were you doing at Gartner. I was in a really unique part of Gartner, which is called Gartner digital markets and GDM was actually combined. So Gartner acquired three startups that were in the same market effectively in competition with each other, so it acquired all three startups kept Tara software advice and get up to, and these were all websites that helped startups small business owners find the right software to help grow their businesses and Gartner had always focused on the enterprise they mostly served companies with 500 employees at least and above to help them make the right technology choices for their businesses and so GDM was really their first for a into the small business market. So as a result of that they hired editors and analysts and writers to cover the technology sector for small business owners and entrepreneurs. So I spent four years there, mostly specializing at first in project management and accounting software and covering different features and functionalities of those types of cloud software products. And those were not my passion and so and about two years into my time at Gartner I started reading more about the this AI boom that was happening and specifically the different types of AI technologies that were coming to market in a more drastic way, everything from natural language processing to machine learning to facial recognition. And that was where that I really got my interest peaks that was where I found something that I was really interested in diving into in more detail. I transitioned from covering project management and accounting software to business intelligence software. So I would cut I would do things like cover the different features and functionalities of various tools from Microsoft Power BI to Tableau. I also co wrote papers talking about different things like semantic analysis and chat bots, different different things that folks should be aware of when it comes to accounting for bias I wrote a few I co authored a few Gardner research notes on cool features in different spaces like speech and natural language processing. And so it was a really interesting space to be in, because Gartner's job is to be at the forefront of technology advising clients and readers on what they should be working in versus what they should be skeptical of. So for someone like me who loves to read and loves to absorb a lot of information that was a really ideal job. And I think that that experience has really served me well. And it was also, like I mentioned a really interesting part of Gartner to be in because it really had that startup small business feel within this larger Fortune 500 company. Ready to share your knowledge and network with your data peers. Join us in San Diego this June for the data governance and information quality conference. Five days packed full of new perspectives, new colleagues and new approaches are yours when you register at dji q 2023 West dot university dot net lock in early bird savings when you register by May 5. We'll see you there. I love it. And then. And then from there you went to steampunk where you are now. Yes, and I've been steampunk since 2020. Nice. So, what then is your definition of data and how do you work with it. That's a that's a great question. I would say data is a point of information. That's the best way I can think of to describe it and I do think it's an important description because everybody has their own ideas about what data is about what governance is. You have to, I think, start any conversation about those topics by defining what you mean. And so I would say that data is a point of information and so that can be anything from your birthday to your social security number to your city that you live in. It can be anything, but it's a it's a piece of it's a point of information and and taken out of it can be used in many contexts that's the other thing is that data in and of itself is not valuable or helpful that's something that I say in the book because there's all this about the volume of data being produced and the implant the implication is that it's valuable on its own and that's actually not the case at all. It can left unchecked be actually a huge liability for businesses and I think and it can be far from helpful if you don't have that data within its proper context and so I think that's also a really important point when it comes to governance. That's pretty much so. Now, and especially since you work so closely with AI and, you know, how do you see and this kind of this crosses a point of contention, you know, do you see the importance of data management and the number of jobs working with data, increasing or decreasing over the next 10 years this AI going to you know get rid of our jobs you know what's that what's happening there you know and why. I want to see a rise in the number of data specific roles, because I think it's becoming very clear that the volume of data being produced today is way too overwhelming for one person to handle the past I think if you talk to any diet data or a dentist or chief data officer they will tell you that over the past decade, people have tried to just give them any and all data in their organization for them to figure out what to do with it. They will also probably tell you that they spend the vast majority of their time clean cleaning spreadsheets and data to get it ready for production, they will then they don't spend as much time building the fun models that they're sold as the cool job. And, but I think we're even seeing now that in this cost cutting period we're in an emphasis on business value and I don't think that in and of itself is a bad thing because I think there has been kind of carte blanche over the last decade to throw money at people who have these very particular skills, assuming that just because they have the data science title, and the company has a lot of data that there will naturally be synergy to use business jargon. And the reality is, if you don't have data governance established if you don't have quality standards if you don't have a strategy for which data you are going to use for which business use cases. All of it falls apart and you would be shocked at how few organizations have that you'd be shocked at how many she faded data officers either do not have a strategy for how to connect particular data pieces to particular business problems, or how many are not given the resources to execute that strategy that they're responsible for. And so I think we are going to see an increase in investment in roles devoted to managing data, especially when it comes to AI, because the sector as we as evidenced by chat with this popularity is growing in spurts that get that are very large and sudden, and that's going to trigger a lot of jobs. That does not mean I don't think that it inherently there's going to be more value created or that those jobs will even last over the long haul but I do think that there is going to be increasing demand for people who understand how to work with data and that's another thing that I cover in the book is this idea that we really need to move away from data management as being the sole responsibility of the chief data officer or the data scientist team or the data engineers, we need to equip everyone in an organization to understand the very basics of data governance and what that looks like for the data in their domains. And that is something that is still very new. It's still something that not a lot of people are willing to invest in, but I think 10 years from now, people are going to have no choice because there is going to be officially too much data, and it's going to be too big a role in everyone else's job that you are going to have to know the basics of it. That's a great point indeed, very important. Yeah, I wouldn't disagree with that. So if somebody's looking to get into a career in data management and maybe a service designer what advice would you give, you know you mentioned that you know we need more journalists, you know, more more of that skill set. And what advice. So how would they get into that kind of career. I think ultimately the biggest skill you can have to have a good career in data is to know how to ask the right questions and be really interested in the business that you're serving and the people who run that business and the reason I emphasize all of that is because ultimately again the data scientist job is to create value for the business using data, the data it possesses, and they can't do that we can't provide value if we don't know who we're serving and who our users are. And so this is and this is something that constantly comes up because certain people just want you to take the latest framework or technology and run with it and implement it, and you'll do all the data governance stuff later and the user interviews and design design later, I have heard will do design later more often in my career than I would like to count. And it's and I really think at the end of the day, whether you are on a designer path or a data science path you do have to understand very clearly who your users are what they need from you, and then how to design a model or a service or a product in such a way that it fulfills those needs, and that really comes down to asking the right questions and knowing who you need to ask those questions of. It's really good advice is there a question that you find that is commonly missed from people is there like a couple or one or two good questions that you should ask. I think the framing of those questions is really important so you want I think you want to stay away from questions that could elicit a yes or no answer because though and that can happen a lot especially if you're working with people who are a little more introverted they might have more technical roles like if you're working with scientists or statisticians and they, they get a little cagey or about the conversation you're having. You want to steer away from, from anything that could elicit a very simple response that cuts off the dialogue you instead want to say things like how do you, how do you fulfill X function or tell me about your process doing, doing xyz or what did you, what did you, what, what makes you frustrated at your current job or using this system you want to use words like how, when, what, who those types of things as opposed to do you fulfill xyz because then that's a yes or no question. And you really want to get when you're having a user conversation as open ended feedback as possible. I also think it's important to keep that feedback confidential where possible. This is especially important for political reasons if you're interviewing colleagues of your client. And then on top of that I think it's really important that you're if you're building personas or user roles. It's really important for those personas and roles to be informed by conversations you've had with real users. There's a pretty big backlash in the design community now against personas because they are often unvalidated archetypes of particular users that are not based on anything but assumptions and stereotypes. And in design, we say that everything is an assumption until you test it. So you put together, you can put together, you know, a low fidelity prototype or mockup based on what you know, but then your job is to validate those assumptions with the right people to make sure that you are on the right track. And so I also think that one important piece of doing these user interviews is that you always want to make sure that they are not happening in and of themselves that they are informing personas but that they are also accurate and informed the personas are informed by real conversations with real users. It's great advice. That's really helpful. I think I'm going to definitely mentally taking notes there. You need to go back and listen and take notes. Well, and recording them and recording those conversations is also really helpful because that you're just not going when you're leading the conversation you're not going to remember everything that they tell you, you certainly I mean I know people try to take notes and listen. You can't do it well. And so it's important to record with permission and then get a transcription so that you can go back and hear everything and it also gives you a record of the conversation. Very good advice and definitely speaks to your journalist background. It really is a great match that way because I think and I think that's also valuable advice because I was very, you know, sad to be honest when I realized I wasn't going to have that journalism career the way I wanted but then when I unpacked what I really enjoyed about it. It was the opportunity to ask questions of various people to uncover real the root of problems to add to make sure that I was telling the store inaccurate story about the way someone uses a product and so those aspects of the job that I enjoyed are things that I am still able to fulfill, even though I don't have that career that I initially envisioned and so I do think that's something that's important to consider. Well, Lauren, well we're so excited to have you in the data space. Speaking of you know how do people solicit services from steampunk how do they you know connect with you and most importantly how do they find your book. So you can find my book by going to Prague Prague calm. That is the name of the publisher. And so if people go to Prague Prague calm they will find the book there. But you can also buy designing data governance from the ground up from any online book retailer barns noble target Amazon local book shops have it as well so if your local bookstore has it I would love for people to order it from there. I would love for people on all readers and kindles as well. If folks want to get in touch with steampunk they can go to steampunk calm and learn more about us and our services there. And then I am also available on LinkedIn if people want to connect and learn more. I love it, and we'll get those links for me I make sure they're posted on the podcast page as well so people can easily click on them. Thank you. Well, Lauren, thank you so much for taking the time to chat with us today. Thank you so much for having me this was really great and I hope it was the first of many conversations. I agree yeah and to all of our listeners out there. If you'd like to come up to date and latest in podcasts and the latest in data management education you go may go to data varsity net four slash subscribe until next time. Thank you for listening to data varsity talks brought to you by data varsity subscribe to our newsletter for podcast updates and information about our free educational articles blogs and webinars at data varsity net forward slash subscribe.


It's dark. I'm in the car I am headed to boot camp. It is currently Monday that I'm filming today's video My girlfriends were here for the weekend from San Diego and we had such a great time I actually posted some photos and things on my Facebook group. So definitely if you're not in my Facebook group come join us It's free. We'd love to have you you can see that post and all the photos of my friends and I over the weekend I was incredibly incredibly incredibly active while they were here I actually did boot camp hiked up to the top of a mountain to Tumamoc, which is my favorite mountain to climb We had a ton of steps over 15,000 every single day while they were here I'm sore from Friday's boot camp my calves are sore my arms are sore I actually lifted weights in the gym yesterday. It has been a very active weekend So I even debated about going to boot camp just because I am so sore But I told myself you need to be consistent. You're committed.  We're going to boot camp. It is already 80 degrees here. It is not even 5 a.m It's 451 to be exact. It has been really hot well over a hundred degrees every single day here So I did bring a water for boot camp and I'm actually glad now that I'm in the car. I'm glad that I'm going I'm gonna get my workout in I'll be done by 6 a.m I don't have to stress about working out in the heat. So I'm glad that I'm going I'm looking forward to it You guys know, I always feel really good after my workout, whether it's the gym walking or boot camp So I'm going I'm going I'm going I'm going yesterday I put out my supplement video about all of the different supplements that I take that have helped me on my weight loss journey and I've been getting a lot of questions on Motivate because you guys seem to be really interested in the motivate supplements because I take Several of those and those are really the ones that I take almost every single day So what I'm going to do today is I'm going to show you how I incorporate Motivate supplements throughout the day. When do I take them? What do I take? How do they play a part in my day today life? And hopefully that makes a little bit more sense on how I incorporate especially motivating supplements every day Like I said, that's the brand that I take the most so I'm excited to share that with you We have some really good food in store today. It's house cleaning day today So we're going to spend some time today cleaning the house and we'll just kind of see where the day takes us So let me head let me go ahead and get my workout done. That is step number one So I am home from boot camp. I just got ready for the day I took my hair out of the braids and it put this fun kind of wavy summery beachy look to it So I'm going to go ahead and roll with that today. It's actually hair washing day So I'll be washing my hair tonight, but I kind of like that it gave it that kind of curly look So now that I'm home and I'm ready for the day I need to take my morning Motivate supplements and then go ahead and dive into breakfast because I'm definitely hungry I did finish my protein coffee while I was getting ready. I always make it before I go to boot camp And then I finish it up when I get home. So for my morning supplements besides a multi vitamin There are three motivate products that I take daily first is the motivate hair skin and nails You can see actually mine's almost gone. I've already ordered a refill I've been taking a hair skin and nail vitamin for a very long time I find that it really helps with skinny elasticity keeping my hair nice and healthy my nails strong Especially being in a calorie deficit and maybe not getting in all the nutrients and minerals that we would if we were eating a little bit more I really rely on the motivate hair skin and nails. This is such a fantastic Supplement so I take one of these every day. I also take the motivate detox I talked about this in my supplement video.  It's just a really great product I do take two of the motivate detox every morning And then last but not least in something that I've kind of been introducing recently and I've really been loving actually both Tori And I have been loving are the motivate turmeric gummies these help with vitality performance and stamina So these are actually really good to take pre or post workout Sometimes I take them before I work out sometimes I take them after but they're always part of my morning vitamin ritual They look like cute little orange gummy bears. They taste really good They do have a little taste of turmeric, but they're kind of sweet at the same time and I really like these this says ginger flavor They're 60 gummies and I take two gummies every single morning. So these are my morning motivate supplements I do have a 20% off discount for motivate, which is Amazing so I'll make sure that that is linked down below now that I've taken my supplements. Let's put together breakfast So here is breakfast So this is my ham and cheddar oven baked omelet that I made in Monday's meal prep If you miss meal prep, I'll link that video down below for you This is just a easy way to make an omelet and also get in a ton of protein I always like to supplement protein post Workout and then I have some blackberries as well That's going to give me a healthy carb and some added fiber Well, look Well, do you want to treat for mommy? I know you've got your eyes on daddy's food, but do you want to treat for mama? Pete out. Do you want treats? No, I know you're on your treats Come on It's particular. Hey dog, why are you not eating your special bone? Oh, daddy took it. Oh He took it buddy He's gonna even sit in there for 20 minutes with it. I work out an after-break this That is when I use my motivate recovery. I use this every single day. The kiwi strawberry is my favorite I also like the mango pineapple one. They're both really really good, but right now. I've been just loving the kiwi strawberry It's kind of those summer vibes that I'm after what I do is I add one scoop to any water bottle or Glass sometimes I use my Stanley sometimes I use my Lululemon water bottle So I'm going to add one scoop of recovery. This is going to help with muscle soreness muscle recovery It's going to give me a little bit of energy some BCAA's and basically just help me recharge Post-workout not to mention it tastes really really good. So it helps me get in my water That is one of the other side benefits of the motivate powdered supplements like the energy water enhancer the burn It helps you get in your water, but also gives you all of the added Benefits and one other really good benefit of the recovery is there's electrolytes, which we always lose when we work out I was really sweaty today. It's actually monsoon season here. So it's muggy for the desert So I was pretty sweaty. So that's going to help me recoup all the electrolytes So I just got off of a coaching call. I have another one in about 25 minutes. It's almost 10 I'm hungry. So I'm going to have a morning snack. We're gonna have a yogurt bowl That's one of my favorite favorite morning snacks and then I'm going to get my greens in for the day Which is the next supplement that I utilize from motivate for my yogurt bowl I've been doing a Chobani zero sugar yogurt. You can use any yogurt This one just happens to be my favorite today I opted for blueberry and then I use a fruit in on my bowl today I'm gonna do blueberries just because I did choose a blueberry yogurt I top it with granola and it can really be any granola that you want to use I add a tiny little bit of whipped cream right now I have the strawberry whipped cream from target from the favorite day brand and then my favorite part of my yogurt bowl is chia Smash, I'm going to use strawberry. I have a couple open chia smash in my fridge at all times I actually bought their six pack, which is all of their flavors on Amazon. This is amazing It's four ingredients. It's strawberries dates lemon juice and chia seeds really really clean and the perfect addition to my yogurt bowl I'll link the Amazon chia seed pack bundle down below for you And then I'm going to get in my greens for the day I've been really focused on making sure that I get in my fruits and vegetables every day from motivate Of course, I use the greens supplement. I have both the tangerine and the peach I actually have them both today. I am going to do the peach I really like these because it helps get in my veggies and my superfoods. It does not taste like greens It's very very fruity. There's no grassy taste, which is what turns me off from greens That's why I love the motivate so much and they also have the little sampler packs that have both the peach and Tangerine in them. You actually get four packs to have each flavor I like to have these on hand as well. This is what I take whenever I travel and then I use the full-size tub at home I'm going to add some water and some greens to my Lululemon bottle To put together my lunch and I'm going to be doing my meal prep lunch Which was my spinach peach almond salad. By the way, it is so good Like I said, if you miss meal prep from Monday, I'll link it down below, but it is going to be a spinach base I usually do about a cup cup and a half of spinach. I have some sliced purple onion sliced almonds Peaches I went ahead and diced up some peaches. This is kind of the star of the show I also add some avocado and the homemade vinaigrette that we actually made in meal prep and then I put these just bear chicken pieces in my air fryer and I had these for lunch in the meal prep video and then these are the Leftovers, so I'm going to weigh out four ounces of the just bear chicken chunks to top my salad I almost forgot that if I'm still hungry I might have one of my raspberry oat bars that I made in meal prep But let me put together my salad. So here's my lunch. Here is the spinach and peach Salad with some avocado some sliced almonds. We've got chicken feta. It is really good Very bright very summery salad So Troy and I are about to start cleaning the house and I need an afternoon pick me up If you didn't notice I did not go get a second coffee today I actually have a lot to do at home today that I decided not to leave So whenever I don't get a second coffee and it becomes the afternoon I always need like that afternoon slump pick me up and to help me make it through cleaning the house So today we're gonna use a motivate burn. I love motivate burn.  You can also buy these in Single packets in a little sampler pack where you're able to try out the different flavors find the one that you really love and then by The tub now. I know what you're thinking. I don't want to have caffeine late in the day or I'm sensitive to caffeine Well motivate also has there no stem now The no-stem one gives you all the benefits of the energy the focus metabolism boosts fat burning without caffeine And it actually comes in Miami lemonade and Kiwi strawberry Kiwi strawberry is the one that I had the recovery this morning That flavor is so good. The Miami Miami lemonade is really good as well But for me, I need the caffeine so I'm going to do the cherry Lemonade so I'm going to add one scoop to my water bottle with some water some ice and start cleaning A coaching call this afternoon and I am going to make a protein shake to drink on my call So I pulled out the last bit of my pitted dark sweet cherries from Trader Joe's and then I'm going to use the Fairlife chocolate milk This just really adds to the protein shake just has a really really good flavor And then I'm using my Motivate chocolate protein Motivate has both vanilla and chocolate. They are fan Tastic a hundred calories less than one carbohydrate 20 grams of protein the chocolate is this really Decadent Dutch really rich chocolate It is so so good and I love it paired with the chocolate Fairlife milk even regular milk And then I thought we could do kind of a chocolate cherry vibe for our protein shake So here is my shake. I have one cup of chocolate Fairlife milk one scoop of Motivate chocolate protein And probably a half a cup of frozen cherries. So here is my shake. So I have the chocolate cherry shake I topped it with some of the strawberry whipped topping from Target from the favorite day brand This is really really good in this 35 grams of protein for dinner tonight. I am making chicken burgers with avocado corn Salsa, I do not have any buns so I'm going to skip the bun But I may add cheese to my burger and then I'm going to roast up some yellow squash and some zucchini as a side So let me show you what you'll need for the burgers You'll need a pound of 96 98 percent ground chicken that will be zero points on ww salt and pepper I will link my little acacia with salt and pepper holder down below for you I picked it up off of Amazon light shredded cheese green onions or scallions fresh cilantro Avocado oil of your choice. You can use fresh corn or canned corn Light mayo and a fresh lime or lime juice. So I have my yellow squash and zucchini ready to go I just added a tablespoon and a half of avocado oil and then I added some salt and The green goddess seasoning from Trader Joe's. That's what I topped it with. I really like it on roasted vegetables So I'm going to throw this into the oven at 425 until they're roasted So for the chicken burgers, I added my pound of ground chicken to a bowl. I have my diced up green onion One cup of light shredded cheese one quarter cup of light mayo Salt and pepper. I sprayed my quarter-sheet pan with some non-stick cooking spray We're digging in with our hands and we're going to mix the ground chicken mixture all together and then form it into eight chicken patties I'm going to put my chicken burgers in the oven right alongside my zucchini and let's go ahead and make up the Corn avocado salsa so for the corn avocado salsa You're going to put the corn oven the entire ear of corn in a bowl. I'm going to add my entire can of corn About a half of a cup of chopped cilantro Your large diced up avocado half of a tablespoon of oil The equivalent of about half of a lime Juiced and then salt and pepper to taste and then mix that up until fully combined I'm going to go ahead and toss it in the refrigerator while my burgers are cooking as well as my squash and Zucchini this looks really good. We're basically going to top our burgers with the salsa So the chicken burgers are out of the oven. These look super super good We have our avocado corn salsa and my roasted yellow squash and zucchini I think I'm going to have two of the burgers are super low point since I don't have a bun The recipe does make eight servings and then I'm going to dish up some squash and zucchini as well So here's my dinner. I have two of the chicken burgers with two servings of the avocado corn salsa zucchini and squash Everything is on my uba home plate. You guys know I love these pre-portion plates I will link them down below with a discount for you and I'll put points calories macros here on the screen So a four dessert tonight. I'm keeping it pretty simple. I actually ordered the solely gummies. These have really good ingredients This is the mango and orange gummies. I ordered these off of imperfect foods. I love these These are super good 70 calories per pack So I'm going to have that and then in my Sam's Club Hall I got these little cups brand. These are kind of a keto dessert, but they're just a lower carb lower sugar dessert I love the mint ones. These remind me of a York peppermint patty Super super good, and I want to say 80 80 calories for this. So I'm going to do these for dessert Thank you for joining me for today's what I eat in a day on WW I hope you enjoyed coming along with me today seeing all the good food that I eat how I utilize Motivate supplements to not only help me lose weight, but help me recover from my workout and kind of what vitamin regimen I take in the morning. Don't forget. I do have a 20% off discount for motivate I will link it down below for you as well as everything else. I shared with you today Nutrition coaching highly highly recommend tonight's dinner recipe is on my website, and don't forget come join my Facebook group We would love to have you. Thank you so much for watching friends. Happy Wednesday, and I'll see you in Friday's weigh-in Bye


Welcome to this CHEST 2020 presentation on Low Latency Hardware Masking with application to AES. My name is Pascal Sastrich and this was a joint work at Rambus with my co-authors Wigel Bilgin, Michael Hutter and Marc Marsen. Throughout this work we try to address and answer the research question can we implement mask hardware circuits that can be evaluated securely with low or zero latency overhead? As part of the answer we also addressed the following problems. What is the suitable hardware masking scheme with respect to a low or zero latency overhead? Is the masking scheme of choice composable and robust against glitches? Hence can we design a full hardware architecture based on small, secure and glitch resistant components called gadgets that can be connected without reducing security? Can the chosen masking scheme provide zero latency overhead compared to an unprotected design? If so, what is the cost in terms of area, performance or fresh randomness? If not, what is the lowest latency overhead that we can achieve? Eventually we would like to address the problem of building a secure, single-cycle-per-round AES implementation with this approach. Let's start with addressing the first problem. What is the suitable hardware masking scheme in particular with respect to low latency applications? After our initial research we decided to use the LUT-based Masked Dual Rail Precharge Logic Masking Scheme, short LMDPR, that was presented at CHES 2014 and describes a first-order, secure, gate-level masking technique to build protected gadgets. Let me explain the general construction and operation principle of a protected gadget first, before answering the question why we decided to use this specific masking scheme. Each LMDPR gadget operates on two Boolean shares in order to provide first-order security. In addition, one of the shares is also provided in complement format, used internally for the dual rail logic. Moreover, each gadget is constructed based on two separate layers. First, the Masked Table Generation layer using a first share and some fresh randomness to generate the Masked Lookup Table to process the second share. And second, the operation layer processing the second share and the complement using the generated Masked Lookup Table. However, the randomness and Masked Table are only required for nonlinear gadgets, while linear gadgets have independent layers and each share is processed individually. As we can already see, the data path within each gadget is fully combinational, independent of the function implemented by the gadget. But we also must note some restrictions when using and implementing LMDPR gadgets. First, we can only use monotonic gates within the operation layer. And second, each gadget is operated in two phases that are called pre-charge and evaluation. Apart from these restrictions, LMDPR seemed to be a good and simple candidate. In fact, after our initial research, we decided to use this masking scheme mainly for two reasons. First, as already mentioned, the data path in each gadget is fully combinational, making it a good candidate for low latency optimizations. And second, the original LMDPR paper already presents an AES architecture based on LMDPL that has a two-cycle per round latency. As we opted for a single-cycle per round latency, LMDPR seemed to be a good candidate for our purposes. After explaining the basic construction and operation principle of an LMDPR gadget, we now have a closer look at the theoretical security, in particular with respect to composability of gadgets and security in the presence of glitches, as they naturally occur in hardware implementations, but may reduce the security in practical realizations. In the original LMDPR paper from chess 2014, the security of a nonlinear gadget was investigated using activity image analysis. That is, given a certain unprotected input, there is no information leaking based on the gate and wire toggles. This analysis does not discuss the composability of this gadget directly. However, we also show the security using practical FPGA analysis of AES when multiple such gadgets are composed. Exactly how and why the synchronization points or registers need to be introduced is also not detailed. In this work, we aim to investigate the gadgets under the glitch-extended probing security model. This is a model that has gained attraction in recent years, as it provides a format setting that can be directly linked to practical security given the independence leakage assumption on a circuit with non-ideal gates. In order to do so, we first analyzed the strong non-interference of a nonlinear gadget, specifically an AND gate, and discussed how, combined with non-interference of linear gadgets, this enables a direct composition for first-order security. We further discussed which synchronization elements are strictly needed and which can be relaxed due to the inherent synchronization of monotonic gates. Note that our investigation is limited to first-order security, which is the security level provided by the LMDPL gates, and is not directly extendable to higher orders. Before giving a high-level view of the security argument, it's useful to remind that, as it is done in literature, we distinguish an intermediate probe, which gives information up to the closest previous synchronization point, and an output probe, which gives information on the value itself. A gadget is one GSNI if the observation is of a single intermediate probe and the information gained from this observation is independent of at least one share. If the observation is of a single output probe, the information gained from this observation must be independent of all input shares. Our security argument relies on two implementation assumptions. First, the operation layer circuit, using shared sensitive information, is implemented using monotonic gates and wiring only. Second, each monotonic gate is pre-charged. The structure of the circuit and the monotonic gates is kept intact using don't-touch constraints during synthesis. Given these assumptions, we observe that the gates in the operation layer do not glitch. Therefore, a probe on an output of a gate cannot be extended to give information on all its inputs. The information gained from the output of the gate is its value itself only. We checked that for each SI the information is independent of at least one input share and for X2 it is independent of both input shares. The mask generation layer depends on only one share and additional randomness. Hence, it can be implemented completely independent without monotonic gates or registers. Finally, the mask table output, which crosses domains, needs to be registered to ensure pre-charging and synchronization. For more details on this and further discussion on the absence of timing leakage, we refer to our paper. Next, we are briefly going to discuss the latency overhead of this scheme and whether we can reduce the original two-cycle-per-round construction to a signal-cycle-per-round construction. To explain our approach of reducing the latency overhead, we take the example of the original LMDPL-AES design and briefly discuss our main observations that led to a latency reduction. The original LMDPL construction has two register stages for a two-step calculation of pre-charge and evaluate. Initially, the registers before the field inversion are pre-charged and the mask share and table generation is active to generate the first table. Next, the field inversion is evaluated while the mask share and table generation is inactive and the table remains stable. Lastly, the remaining linear AES-round operations are evaluated while the mask share and table generation becomes active again and the registers before the field inversion are pre-charged. For the original LMDPL design, the two-phase operation ensures and maintains the glitch-free evaluation. However, based on this, we observed that if the operation layer is pre-charged and if the table generation of all LMDPL gadgets is synchronized, then we can freely compose any LMDPL gadgets without any intermediate register stages. Hence, we could combine all AES-round operations, linear and non-linear, into a single combinational logic composed of LMDPL gadgets. Combined with the principle of duality, we duplicate the LMDPL operation layer in order to ensure that one layer is always active while the other layer is pre-charged for the next operation. Fortunately, the mask generation layer is not duplicated since it does not need a pre-charge phase but can be reevaluated in every cycle. With this, the first operation layer initially is pre-charged and the mask generation is active while the second operation layer is idle. In the next cycle, the first layer is evaluated while simultaneously, the second operation layer now is pre-charged and the corresponding masks are generated. Eventually, the first operation layer is pre-charged again and the corresponding masks are generated while now the second operation layer is evaluated. In summary, this principle could be extended arbitrarily and we can implement any M-round algorithm in M by N cycles. If we can ensure that we have an active N-round evaluation circuit in every cycle. Next, before we show practical security evaluation results of our single cycle per round AES architecture, we will briefly provide implementation results and a comparison to existing low-latency implementations and architectures. For our architecture, we implemented six different options with varying functionality and security. For this, we differentiate between encryption-only, decryption-only and combined encryption-decryption architectures. For all three choices, we implemented options for standard or protected key expansion. In addition, all our designs include a dedicated entropy engine implemented as a PRNG that provides necessary fresh entropy on the fly during operation. Naturally, the PRNG is larger when the key expansion is also protected as we need fresh random masks within the key schedule S-boxes. Further, as we can see, most of the area is consumed by the data operation layer, as this is fully implemented using LMDPL gadgets and also duplicated to ensure the one cycle per round operation. In contrast to this, as already mentioned, the mask table generation is not pre-charged and hence we did not need to duplicate this module. Taking a closer look at our S-box construction, as this is the non-linear and crucial part of our protected architecture, we also provide a brief comparison to state-of-the-art and existing S-box architectures. In general, our S-box construction takes 3.45 kg equivalents in the GF28 nanometer cell library, where the operation layer takes roughly 1.1 kg equivalents and the mask table generation takes about 600 kg equivalents. In addition, the 288-bit mask table register takes almost half of the area, which is about 1.7 kg equivalents. However, with this design, we provide a single cycle S-box that needs 36-bit randomness per clock cycle to ensure secure operation. For the comparison, we focus our discussion here on those alternative solutions that also address or focus on the principle of low-latency architectures. The only single cycle construction we could find in literature was proposed by Kors et al. But in comparison to our design, this approach is very large and uses a lot more fresh randomness during operation. For two cycle latency constructions, we would mainly like to mention the approaches of Leisersen et al., which is the original LMDPL design, and an improved version of the construction of Kors et al. that reduces area and randomness, but still is worse compared to our design. Lastly, we would like to mention the construction of the Maya et al. that is smaller and needs a lower number of random bits, but has a latency of three cycles when instantiated in a full, round-based AS architecture. As this construction must address the zero-value problem of the inversion separately. Eventually, we present the results for our practical security evaluations based on the test vector leakage assessment methodology. Our global security goal was to provide resistance against such an analysis, even when an attacker can observe and record up to 100 million power traces. For this, we performed an analysis based on Welch's t-test using fixed versus random plaintext as classifiers. On the left side of the figures, we showed the evaluation results for the protected AES-128 for a first-order statistical moment analysis on the upper left and a second-order statistical moment analysis on the lower left side. When compared with the average power trace on the upper right side, we do not observe any significant leakage during the entire AES operation, which takes 10 cycles. However, if we disable the PRNG, which is shown on the lower right side, we can observe significant leakage even for lower number of traces. In conclusion, we can say that we achieved our initial security goal and our AES architecture provides resistance against such an analysis with up to 100 million power traces, as we cannot observe any significant leakage in our TVLA results for first- and second-order statistical moments. As an extended security goal, we also wanted to investigate the resistance of our AES architecture beyond the limit of 100 million power traces that we took for our initial security goal. For this, we extended our analysis and even recorded and evaluated 1 billion power traces. Again, we showed TVLA evaluation results on the left side of the figures where the first-order statistical moment analysis results are shown on the upper left side and the second-order statistical moment analysis results are shown on the lower left side. However, this time we can observe some significant leakage for both the first-order and the second-order statistical moment, as indicated by the peaks exceeding the thresholds of plus and minus 4.5. For a more detailed analysis, we also provide the maximum and minimum leakage for the first- and second-order statistical moment as a function over the number of traces. On the upper right side, the evolution of the maximum and minimum T-statistics over the number of traces is shown. While on the lower right side, we also provide the evolution of the T-statistics for the second-order statistical moment. In conclusion, for our extended security analysis, we can state that we can only observe significant leakage after recording and analyzing 400 million power traces for the first-order statistical moment and 220 million traces for the second-order statistical moment. However, we also would like to mention that all our attempts to perform a key recovery for those leakages were not successful. Eventually, we also performed a multivariate security analysis based on bivariate statistics. For this, we captured a full AES operation with 500 samples per trace and normalized all samples in each trace by subtracting the corresponding mean samples. Then, the bivariate analysis was performed by combining two samples through multiplication of the normalized samples. The figure on the left side shows the bivariate analysis results. While gray dots indicate T-statistics within the thresholds of plus and minus 4.5, red and blue dots indicate significant T-statistics exceeding the thresholds. Further, the lower triangle of the plot shows the bivariate evaluation results for an unprotected design with disabled PRNG and based on 100,000 recorded traces. While the upper triangle of the plot shows the evaluation results for a protected design based on 1 billion recorded power traces. For the multivariate analysis, we can conclude that we can observe some weak but expected leakage but only when using up to 1 billion power traces. To conclude this presentation, we can state that we presented a hardware mask single-cycle-per-round AES implementation and proved its first order security under the D-glitch extended probing model. In addition, we addressed the initially formulated problems such that LMDPL is a good candidate for low-latency masking schemes in hardware. It is secure even in the presence of glitches and gadgets can be composed securely to build complete encryption and decryption architectures that are resistant to such an analysis. LMDPL can be implemented with zero latency overhead compared to unprotected designs when using the principle of duality. We presented practically secure round-based AES architectures that resisted such an analysis even when observing and evaluating up to 100 million power traces. With this, I would like to conclude this presentation. Thank you for your attention and watching this recording. If you have any questions or remarks, feel free to reach out to me or any of my co-authors. For the sake of completeness, we also provide a list of references to be used throughout this presentation.