oard of Health second point it's getting to tournament time at the high school athletics I just want to briefly mention two teams that often offer not not really in the in the spotlight but given recent events certainly a deserving of mention that's the girls and boys tennis team at Anken high school and the girls just wrapped up this season with a record of 16 and four they've been in the middle sex league for over a decade and this year for the very first time they defeated Winchester and tennis and oftentimes when the Anken high girls tennis team is playing Winchester you measure it by how long you're on the court whether not whether you're winning or losing and they were successful they had one of the best records in the middle sex league and they're moving on so I congratulate coach Daniel Rakowski and the girls team also want to congratulate coach Matt Siegel of the boys team they have made the tournament as well with a record of 13 and 7 and that's uh the Liberty League in the middle sex league within the middle sex league um is a very difficult and very competitive um division for for tennis and and both teams made it to the tournament and I want to wish them well as well as all other teams from Anken high school and I think Catholic that have made this tournament thank you thank you Mr. Corsi hi Mrs. Hyde I'm sorry oh my goodness wow this is my hi or you can call me Mr. Greeley I'll answer them either um I I know uh our director of veterans affair chef Chango has um events uh planned for May 30th um I'll definitely have a conversation with the chairman because um there is a proclamation but kind of hoping it's going to be surprised to the recipient so I'll check with the attorney hot in the right way um I mean I'll I'll get I have the proclamation right here right now but I'll um uh get it to the chairman uh for Monday May 30th events um and we'll go from there because I I think uh depending on I know it's Memorial Day weekend of of who can attend um but I know um several of us will be there so um um and then the only other thing is I just want to say um and I've had conversations with the turning home about this um the really good news from EPA they uh came out and uh they sent uh a letter to uh city of Cambridge city of Summelville M.W.R.A. and Department of Conservation and Recreation D.C.R. um with everything that the town of Allington uh through Save the L.W.I.F. and Mr. River Watershed Child's River Watershed um all um along with the town the town manager turning home um and sporadically myself um have been attending meetings and they're now making it requirements um uh and pretty much have addressed everything the uh one of the points that used to get thrown back to Allington is you know you're not addressing your I.N.O. program well guess what we are you know with our own funding with opera funding so that's no longer an issue um so what's in there is dredging um the L.W.I.F. Brooke and or uh sort of eliminating it as a channel um but developing a plan I'm not saying this is you know gonna happen overnight but developing a plan to eliminate the C.S.O.s and the reason they're bringing D.C.R. in which um Dan Driscoll is the person over at D.C.R. who heads and spearheads this and he and I have bucked heads for about 20 years we don't get along so if you want anything from Dan Driscoll don't say you know me but uh one of the sticking points when he decided to do the Greenway and encourage kayaks and canoes and uh launches for them to go into the L.W.I.F. was that I said D.C.R. really should be responsible for before you're encouraging people to go into sometimes sewage infested waters with the C.S.O. discharge um you have to at least A notify them of that which he always refused to do and the town would put signs up but B work towards cleaning it up and EPA has now added them on um and what I'd like to do is and I've had a conversation with attorney Heim about this but I definitely want in thinking about it um I'd like to sort of submit a draft to the board um sort of codifying what the EPA has come out with um you know thanking the EPA for that you know we still stand firm in our commitment for all we're asking for is a plan um and uh and then hopefully not hopefully with the plan you know what the time implementation steps would be um and then continue on to the ultimate goal of um total elimination of the C.S.O.s and really having EPA you know definitely a mystery of a watershed but more importantly you know child's river um watershed um and the other one that I'm blanking on uh is really good news for Allington in getting this done and when I first started on this journey um I had said to them you know I would like to see from Cambridge Summable C.S.M.W.R.A. a plan in total elimination by 2050 and they all said well yeah that's something we can do but right now we have to plan for what's going to get done for 2025 well now 2050 seems to be the number to shoot for anyway so anyway so I'm going to work with attorney Heim and as well as if there's any other entity like conservation commission or whoever else um that should send our planning department a separate letter to EPA I really want to just keep the heat on to keep this moving and whether it's a joint letter or separate letter that's fine but I'll have conversations with the town manager and town council get something up in a draft circulated to my colleagues so you can see it beforehand maybe discuss it in a select board meeting and then see if the board's comfortable with sending that communication on to EPA with C.S.M. as they did Cambridge Summable M.W.R.A. D.C.R. and that's it for my new business thank you Mr. Chair. All right thank you Ms. Mahan and my quick new business is that 13 forests open reopen in East Arlington there was a fire at Thrive this was sometime last year maybe about a year ago and and it affected them and they had nothing but good things to say about the way the town helped them out I mean the town helped them find a temporary location made um with um Food Lake mean and it was very supportive mean and and so I just wanted to pass that along I mean so they're back in and and and I'm used to hearing that Tom did well by them so so um with that we are going to adjourn this meeting and then head into executive session so I'm going to turn to Mrs. Mahan for the the motion okay and I just want clarification if an executive session do approve the release of any minutes is that something we're going to come out and vote on in public session or is that something that we'll put on the next agenda and vote on the release of those minutes at a public agenda in the future and well um let's let's come out and and release them and so so yeah let's make a motion that allows us to come out and release them so that we can not have to worry about this another agenda and so is that a clear answer Mrs. Mahan? Mr. Hyman? Mr. Chairman? Yes I think if the board approves minutes for release in the executive session it doesn't have to come out I think if you want to make a motion to go into executive session you should decide whether or not you want to adjourn from executive session but I think you vote in the executive session to approve and release minutes that'll be all you need you don't necessarily need to come back come back out so just to say some thoughts. I'd like to move that we go into executive session to comply with um the approval and or release of some if not all executive session minutes as noted in our agenda as well as to conduct a strategy session in preparation for contract negotiations with non-union personnel sandy pool applicant for town manager pursuant interim town manager pursuant to section 12b of the manager act and or conduct contract negotiations with same and that when we adjourn we will adjourn in executive session. Okay get a second from someone? Second. Second okay it's on a motion from Mrs. Mahan to go into executive session and I have a motion I just want to go check the session a second from Mr. Helmets Mr. Mr. Herb. Yes. Mr. DeCorsi. Yes. Mr. Helmets. Yes. Mrs. Mahan. Yes. Mr. DeGens. Yes. And I'm sorry just taking from Mr. Chair we're we're not going to we're going to adjourn from executive session correct? Yes. Okay thank you. So so I guess thank you.


Yes, come on. Give me a clicky clicky. Clicky clicky, man. Got to do it. Got to do it. He's trying to figure out how to turn his mic on, I think. He's pushing all kinds of buttons. Everybody point and look. Shit, it worked. Cool. Ah, picture. Thank you. Ah, yes. In case anyone hasn't seen my title suggested afterwards, it is, uh, how to put this. Pig's fucking. In many cartoon character positions.  Okay, let's get started. It's just about time.  All aside, I want security. Welcome, everyone. I'm Michael Glasser. Most people call me Lazarus or Lazarus. I'm here to speak. These are a couple of my buddies here. One on the end is a goon who decided to sit on stage and he has a broken hand, so I let him. Next one is Jeffrey, who's going to be a part of this speech a little bit later. And we're still waking on one more, Jeffrey, who is not quite here yet, but that's okay. No problems. First thing to note here is what OSI layer 1 security is in my mind. I'm not talking about, like, bit stream level protection. I'm talking about the fact that in 99% of the security rooms and the IT rooms I go into, I can walk into a company and gain access to privileged data by physically getting there, physically. Either dumpster diving, which is just the last topic, or actually breaking in via huge vulnerabilities. Beer guy! Beer goon! Thank you. I'd like to go a lot more now, goons. Especially this goon. Everyone buy him beer and give him women. Or men if he likes it, but that's cool. Whatever your lifestyle changes, it's cool. Okay, so let's go on to our first slide here. That's my disclaimer. Read it at your own leisure.  He just referenced that if my physical security was better, he wouldn't have been able to steal my beer. He's quite right. But if you try it, I will whoop you because you got a broken hand. Okay. Now, as I was saying, this is my disclaimer. It's a standard disclaimer. I stole it from some guy that's noted it at the bottom of this, Philip Wynn. And you can read it at your own leisure. Let's go on to the next one. Here's my outline. Access control. Access control is a card system, as many of you've seen, when you procs card into your room, keypads, hand reader, fingerprint reader, all of that. I'm going to go over the basic design components. CCTV is a standard camera systems.  Anyway, okay, that's a basic components of that. And a huge security vulnerabilities in both. And considering that is security hardware, it should be secure, which it's not.  Proximity detectors. I'm using HID, or HID, as some gamers call it. It is one of the more standard brands out there, very popular. I'm in no way supporting or being against HID. They just happen to be what I chose because they're easy to gain access to. On the right side, right side of your screen, is a Maxi Prox reader. That's large of their readers. Proximity technology works, which I'll show in your next presentation or slide, by taking a card and presenting it in close proximity to a reader. It then transfers data through and identifies the card's ID number. Go on the right would be a Maxi Prox reader, which has approximately a three to eight foot read range, depending on what card. Next one, it would be one of the mini Prox readers, which has usually a three to three inch to one foot read range. And the next one is usually about a one to three inch read range. The way it works is that when you present your card, which I will be passing something around, I beg to all of you, I'm going to pass something around with the trust I'll get it back.  So I really appreciate getting it back. What I'm giving away is, or passing around, I should say, are some proximity cards and whatnot. Not giving away, passing around. Okay. As I was saying here, start on that end. Not that delicate. Okay. Hey, dude, find my other one. Jeffrey, find my other one. I can't find it. Okay. The way it works is that on your card, you have a small chip that basically is just, we'll get to what that is, find the other proximity pack. It's a great pack in there. It says HAD on the side. Looks like a proximity pack. There's a huge antenna, which is just that, an antenna, which works off 125 kilohertz. When you come to presenting your card close to a reader, the reader has a huge antenna and some power flowing through RF energy. When you present your card closely, it charges the card with the RF energy. Once the card is charged, the circuitry inside then turns around and spits out a number. So it works like this. The handshake is, reader's here constantly outputting, card is passing, put the card into the field, card is then charged, and output's a number. That number is sent via the data lines and then we'll get to where it goes. That's basic proximity in a nutshell. Now, not all are worked at 125 kilohertz, but considering that HID is the most popular, that's what I'm going to stick with for this speech. And this is once again done in microsecond, very quick. Proximity pros. The reader can be concealed in walls, since it is reading electrically, as long as you're not buying metal of any nature. With a long range reader, I've actually gone through two feet of concrete of actual cinder blocks where we need a secure environment. There was a bad neighborhood. We mounted the reader on the inside and I have a guy who, he's cool. So he walks up with his card and he touches it to the cinder block and he walks in and it works every time. You can keep the card in your pocket. It reads through your pocket. It all depends on what reader you get. Cards can be read through purse or wallet, as we said. Cards are hard to duplicate. The technology behind the card itself, in my experience, is very hard to duplicate. It is possible to buy a card programmer and actually do it, but it's very rare and very expensive compared to other technologies out there that are much harder to duplicate. Unless you're quite knowledgeable, you're not going to build a copier in your basement. Cards really fail. They're very, very versatile cards, not very tough cards. They rarely break. Cards can be stolen without contact, or code can be. We'll get there. We'll explain that in a few more slides. Cards can be used by an unauthorized person. Anytime that you have a device that's non-biometric in certain other things, it's not in there.  Anytime you have something that's non-biometric, it's very easy for it to be given to someone else to be used. It works with proximity tags as well. Wigand or Wigand, depending on who you are. Wigand is another technology that's a very interesting one. It looks a lot like a magnetic stripe. The thing with Wigand is that the way it works is as such. You have a card. Everyone see the card? It's imaginary. Okay. On the left side, you'll have what looks like a bar code, only you can't see it. It's concealed in the card of metal strips. Everyone, Jeff, who's a little bit late here, but welcoming. Come on, clap.  Yeah, it whisper very quietly. Okay, regardless. So what you have is what virtually is a bar code. When you swipe the card through the reader, in the beginning of the reader is a charging circuit, which charges those pieces of metal with a small amount of capacitance I would use. When it then gets farther into the reader, there's a read head. So as you're swiping it through, you get the charged wires at separate distances, and then you get the read head, which reads the gaps between the wires by simply taking the energy out of that. So it more or less is an electronic bar code. This was extremely popular many years ago, well not many, probably 10 or 15 years ago. Not really used for new installations anymore. It was actually invented when they had the oil industry need the way of counting oil. Every X amount of miles down the pipeline, they would add a certain amount of metallic substance, and when it went through, they would have a charging circuit which would charge up that metallic substance, and slightly farther down the line, it would have a reader, which would read up how much of that metallic substance went through at that specific time and gaps and whatnot. Okay, Wiegand. By the way, Wiegand was created by Dr. Wiegand. He's a nice guy, unfortunately he's passed away. He's a nice guy. Beer. Beer? Okay, cool. Bros, cards are hard to duplicate. That wasn't me. Cards are hard to duplicate. They're very hard to duplicate. Physically, they're pieces of metal embedded in the card. You need very good technology to duplicate them. Cards really fail. They're very, very tough cards. The cards are however expensive, let's just move that over there. Cards are expensive, comparable to other technologies. One, because the manufacturing process it takes to make both the reader and the card, and two, because they're becoming less popular compared to proximity, so simple need-demand kind of scenario will make them more expensive. Excuse me. Beer. Dude, take a picture of me with the beer. Come on. I'll show my mom. Oh, no, no, no, not on stage. This isn't jeopardy. I'm not homeridic, dude. I'm not doing pictures. Okay. Cards are expensive. You must keep the reader clean. It can be used by unauthorized people. Once again, you can hand your card to someone else. Let's bang this through a little bit quicker so we can get some fun going. Magnetic stripe. Every one of you here has an ATM card or a credit card or perhaps a driver's license with a mag stripe on the back, and almost everyone has a VCR. It's basically the same thing, a small piece of magnetable, that's a real word, magnetable, but terrible. And it's encoded with a specific piece of data on the back of there, and when you swipe it through, it transmits the data. That's all a mag stripe is. I'm not going to get into too much detail there. Most of the problems here are the good things are it's inexpensive because it's so mass produced. People are used to it from banks and hotels, and your ATM cards, you're quite used to it. People can use their existing card in some cases. I stated Caesar's the first three nights I was here. They have a safe in the hotel. Now, if you want, you can go to the safe and open it, put your stuff in, swipe your credit card. Now the only card that will open it until three set is your credit card. That way you'll never have to trust hotel security for any of those things. Okay. Have to keep your reader clean. It's a physical reader. You're physically swiping through it and it must be kept clean. High failure rate of cards due to a scrapes of the line. Everyone's scratched the mag stripe and it stops working.  They get dirty, they get clogged, reader heads go bad, they take lightning hits. Technology just happens to have a lot of failures. Cards can be easily duplicated. Anyone who has access to the internet and old VCR can build a card copier. All it is is read-write heads with magnetic heads which are once again available in the VCR. You can easily online buy a card reader rather. Cards can be used by an unauthorized person by hand either way. Key pads. The key pad in the fold in the middle is a little bit interesting. It uses, okay, how do you pronounce it? Piso, piezo, piezo. He says piezo. I said piezo. Let's call the whole thing off. That's called the whole thing. Damn right. Okay. Well, it uses piezo, electronic technology for that key pad. That key pad is actually both bullet resistant, small gauge for you, not small gauge, small caliber for him because I know him. And it's acid resistant, it's bodily fluid resistant, it's very vandal resistant. It's on the cut sheet. I have to say that. It actually says it resists bodily fluids. Now it's, I haven't yet put bodily fluids on the key pad, but one day. You'll see. You'll all see. That's a question for you. Yes, sir. Is your mic on? I believe so. I think it's on the opposite of it. Okay. Why is there so much reverb on your microphone? I don't know. I was going to smack the AV guy because I can hear myself. I sound like God. Hello. Hello. Okay. Well, since, is it getting better? I don't know. Well, I'm not the AV guy and I don't see the MACD sound board they're probably using. They got off of eBay. Oh, well. Okay. Key pads. Key pads are very convenient because you can never leave your card home. You can never forget to take your card with you. You can't forget your code, but that's going to be rare. It can also, so let's go through my pros. Inexpensive. You don't have to issue a card to every single person there. You can give one code for many people or many codes for free. Almost unlimited codes. Well, I do the math of how many with a nine-digit keypad or 10-digit keypad. And you can do that many codes without having to issue every single person a card. And people are used to pushing keypads from telephones. It's very common technology. People can make up their own pin codes. Understanding that the security might not be the best if they're using their birthday or the last four digits of their social or the last four digits of the phone number. But in certain applications where you're using keypads, it does come in handy. People can use the same code.  You can have 10 different people come in and clean your place, and everyone of them can just say, hey, what's the code? Okay. And they clean it. The code has never left home, as I said. Now, the code is kind of that you can give the code to anyone simply by telling them, and you can still have the code yourself. The code can be overseen, shoulder-surfing and whatnot. The keypads are often installed improperly, and I'll get to why that is and how that is a little bit later in this presentation. And the codes can be used by an unauthorized person. Biometrics. Everyone awake in here? Okay, good, because, okay, bear, hold on. What if someone forgets what? We beat them up. You know, you ask if anyone forgets the codes, and yeah, but like I said, we beat them up. Yes, sir. Ah, yes, yes, yes. There's a keypad out there called, that actually will help with the code to be overseen problem. There's a few of them out there. One of the common ones is called the Hirsch scramble pad. Come on, okay, he's smiling, a couple other smiles. The way the Hirsch...Feds, yeah. Okay, the way the Hirsch scramble pad works is it looks like a regular keypad, except instead of having buttons, which it does have buttons, it only has LED displays. And now, instead of having one, two, three, four, five, six, seven, eight, nine, it'll randomly scatter all the numbers around the keypads. It'll have eight, three, two, one, seven, whatever. Bunch of code in. Hit enter. The next time you come up to it, it's randomly scattered again. That way, no matter what you do, you're never punching the same combination over again. And they also have a Fresnel lens on each button so that you can't look from the sides to see what the code is. It's quite a good product. I happen to like it. Yes, sir. Does it take long to punch your code in? Well, if you close your eyes and go one, two, three, four, enter. Yes. If you open your eyes and go one, two, three, four, enter. It's, unless you're dealing with large codes, it's not really an issue. It's kind of like if you change your keyboard configuration around, it would take you longer.  There is scramble pad as far as I know does not resist bodily fluids. However, I believe as you can go out to pool too, there are about 15 or 20 condoms still laying around. If you coat the keypad, you'll be good. Yes, it's extremely more expensive than a standard keypad. Okay. Let's get out the biometrics here. On the left side of your screen, you have the LG Iris Access 3000. I like this device. Unfortunately, a lot of people don't because they're afraid of having laser beam shot into their eye. Now, realistically, this isn't what it's doing. It's simply taking a photo of your eye. But most people don't know that. So if you go into any building where they have this thing, just start screaming laser beam to my eyeball and see what happens. See how fast you can get out of that one. Okay. Next one in is the Bioscript fingerprint proximity reader. That's a good reader. It's one of the most popular for a fingerprint. And along your right side there is the IR hand geometry reader. It's a really low-res crappy image, but screw IR because I couldn't find a good one. Okay. Biometrics. All a biometric is is something that is really you.  It's not something that you know like a pin. It's you.  And that's all a biometric is. The reason why it's great is the fact that you're probably not going to cut your hand off and hand it to your friend.  The verification is a lot harder to fake a fingerprint reader. Don't start. It's a lot harder to fake a fingerprint reader than it is to fake other devices.  Voice recognition has kind of gone out with the times a little bit more than it used to be kind of popular. And now with digital recorders, it's a lot easier to break them. There's still our methods that use the timbre of the voice and certain things of that nature and frequencies you can't hear that still will work. But I'm not seeing it as much as I used to. And the credential was never left home. You can't... Let me change that. You shouldn't leave your fingers home. It hurts. Oops. See? No, that's... Ah, you got you. Okay. Cons. Very expensive. Biometric readers comparable to other readers are very, very expensive. Privacy issues with fingerprints is the fact that a lot of people, particularly unions and government, want to control where fingerprint information is stored. And their fingerprints are used for a whole million of things. Now, depending on which reader you use, some readers can have the data taken out and used in the ASIF FBI system or ASIF government fingerprint identification system. Some readers can't. Choose carefully. Ask for paperwork. Always ask for paperwork. Let me get there before I go any further. Anything in physical security, most of us... Now, I've been doing physical security a long time, just been doing a little bit longer than me. I'd be confident in saying half the guys in the industry are scumbags. The other half are really nice, but half the guys out there are. Ask for paperwork to back up everything. Well, if there's two of us here and half of the people are scumbags, which one is the scumbag? Beer. Beer. Is that a question over here? Yes, sir. Comparable to... On the scale of 1 to 10 of security in physical security being the vault in the bottom of the mountain as 10 and DEF CON is 1. Sorry, guys. I'm going to get hit by a goon later for that one. Okay. The real deal is that biometrics are probably... Compared to a proximity reader being at... Let's say a magstribe being at like a 4, a proxy reader being like a 6, biometrics would be like an 8. It still can be beaten by faking out the fingerprint reader, faking out the facial recognition, but the hell a lot harder. And the knowledge to do it is much less common. Unfortunately, the people here... Let me change that. Fortunately, the people here happen to be very intelligent and breaking most types of security, and it doesn't seem like a big deal. Most physical security is targeted against the idiot, which is most of the rest of the world, unfortunately.  That's who we're really looking to keep out. If you can find some guy off the street and randomly take him, give him half an hour to beat a fingerprint reader and if he can do it, I'll buy that guy a beer. Okay, next. Privacy issues with fingerprint readers. We went through that. Most readers must be maintained. They usually have some kind of a lens or some other device or a microphone in these maintenance. And you're right. This mic has terrible amounts of reverb on it or something. Tweak it, dude. Tweak. Tweak, tweak. No, you can't.  Maybe if you sang the presentation, it would sound better.  You haven't heard my voice. Okay. Most readers are easily damaged. The majority of the fingerprint readers out there, if you take your knife out and scrape across the reader, you're in a lot of trouble. That really needs to be replaced 90% of the time. Optical readers are now using a plastic cover or sometimes a glass cover so that that's not as much of an issue, but you still took that reader out of commission until they replaced that lens. Okay. Overview of system design. Door controllers. Now, later on in my presentation, this is going to be my human door controller when we simulate how a system actually would work if we have that much time, which I hope we do. By the way, official timer, dude. What's our official time? Aren't you the official timer, dude? It's 12.20. Okay. So we're going to bank through the rest of this real quick, then. Door controls it. What? 30 minutes to bang this through really quick. Okay. Every access control system has a door controller. This is basically a control panel where you have all your inputs coming back to, such as your door position switch, which tells you if the door is open or closed. Your reader, which so far we've gone through many different types, biometrics, card, keypad, request to exit, which when the door controller is sitting there, it says is the door open or closed? It's closed. Good. Next time it opens, it should be told to open, such as by a card or someone requesting to exit through that door. Well, auxiliary inputs for whatever you may need, power to turn it on and come to come. Outputs. Main door relay. That's where you connect your door to. Well, auxiliary relays for whatever you may need it for, such as you card in and turn the lights on. That's a popular use.  Communications, once again, there's two types of communications for this panel commonly. Excluding the newer panels, which do use TCPIP for everything. The first type of communications is generally an RS-485 bus, can be 232, between the different controllers to network them internally. And the second type is between the computer and the controller itself. Small system design here. Systems under the 50 doors are what I consider small. Most access card systems out there actually block 32 doors as a small system, but 50 is a good number because I like 50. They usually use two or four door controllers. And instead of having a door controller for each door, you have a two or four door controller. There's a basic design. Rexx detectors request to exit push button or motion detector, which will get some of the security vulnerabilities of the motion detectors a little bit later. Door contact tells you if the door is open.  It locks the door. The reader reads the data in. The access control panel is the access control panel. And the alarm is for certain things such as if someone had propped the door open. You walk over the door, you just leave it open. There's no point in having access control if you just leave the door open. Or if someone comes up the door and forces it physically open with a crowbar. Now, you haven't seen a card in and you haven't seen a request to exit, so it will set off an alarm. And the computer, I think you guys can figure out. Large system design. Let's skip over this. Okay. When you get into large system design, you get into some serious problems with the amount of data that's got to be processed to any single time. So I have a couple of examples here of what can happen and has happened in real-world environments in the past that is a real issue. For example, I'm not going to read the word for word here. But your access control system is a big system. You're in New York City, you're in Times Square, you're in Los Angeles and Hollywood. You've got a large system with a lot of doors. In the front of your building, you have 20 turnstiles for the inflow of the people. You have 15 or more turnstiles across the street for those people. You've got 10 doors in the building down the block. You've got 25 doors somewhere else. You've got another 120 doors in another off-site location, all being controlled by the same centralized computer. You do have door controllers everywhere, but all the data and all the logs and all the files are coming back to the centralized computer. They're making 9 a.m. on Monday morning. You've got people coming in everywhere. You've got people coming in through the turnstiles. Every door is operating. Everything's going at once. Now all these log files have to go somewhere. So they're coming in this control panel, immediately getting spit out into this access computer. This computer is chugging along. It's age 50. No problems. Getting maybe 100 reads a minute. That's fine. Suddenly it starts getting thousands, literally thousands of reads a minute. And it just starts to smoke and crashes on you. Whose responsibility is it that they decided to stick this access control panel on the shitty 46 from the basement? It's usually the IT director who had, well, you need another computer in the network room. We've only got some rack space over there here. And stick something in there that had just happened to find. And nine times that it tends to the shittiest thing they have laying around. And the power supply, half works and half doesn't. I mean, you've got a lot of issues with these things. So okay, this thing crashed nine in the morning. All your log files are down. Okay, that's no problem. The controls are storing it.  Didn't really lose too much. As soon as you restart your program, hey, there's still the log files there. Takes all the log files to the controller, dumps them into the computer, computer crashes. Once again, you're out. It's really, you have to be careful of how much of a load you're going to be putting on these computers. We do give you minimum specs. Please use them. Seriously. Okay, you've resolved the issue. It's 1 p.m. You just hired two new employees and gave them their cards. Wonderful. You still have all those logs downloading from before though. It's a little bit slower now, but still have logs coming in.  You go to swipe through. The card doesn't work. Why doesn't it work? The controllers are still busy downloading all the logs back to the computer. They haven't had a chance to update from the computer to the controller to the new card jet because they're so damn busy because you guys didn't have good enough computer. So it's still just waiting there. This guy's downstairs at the door, swipe. Doesn't let him in. Swipe. Doesn't let him in. What does he do? He goes to the security guard. The security guard goes, well, the card doesn't work. What's the problem? Well, the card doesn't work. I can't let you in. This is my new job. I have to. Okay. Well, who should I call? He's out to lunch. So now you're standing by the front door. You finally get in. It's been half an hour. You go upstairs. The boss is sitting there.  You're fired.   Stand-alone devices. Beer. That's a very important part of all this. Okay. Stand-alone devices. On the left, you have an IEI keypad slash proximity reader. On the right side, you have a stand-alone device made by IEI as well with a keypad and a lock built together. Other devices out there, which I've seen in this hotel, is the Trilogy T3, which is another one that looks very similar to that. There's also, I saw at Caesars, which where I was out a couple of days ago, they had the Ingersoll Rand version. There's many different ones. Bless you. Okay. Sometimes you can't get wires to a door with these stand-alone devices, such as if right here, we didn't have a drop ceiling. This was all a vaulted ceiling. This was a church. And you have an old, old, old door. At the side door, you want to get access control on that door. You don't really, really need immediate log return. You don't need alarms to go off. You just kind of want something so that you don't have to carry a key. Pop a stand-alone device on that door, and you're good to go. Change the batteries once every three years, and you're ready. Otherwise, you're going to have to run conduit along the walls and everything else. It's not a good thing. Okay. Before we get to problems with security vulnerabilities, any questions? No, no, no, no, no, no, no, no, no. Price ranges. Price ranges are hard to judge. You can really go in the close to under $100 if you go on eBay, all the way up to, I've seen stand-alones in the multiple thousands. It really, really is hard to judge, depending on your needs. I'd say a good ballpark is to say, in the middle of a five to six hundred list price, uninstalled off the shelf. You probably can, you can go a lot higher than that, depending on what you do. Yes, sir. Yes, there are devices that use wireless. There's a company called, used to be called Wireless Access with a Y. I believe they changed their name to RF Access or something like that. Or Recognition Systems now, I believe it is. No, Recognition Source, and it used to be called Wireless Access. They use RF to transmit between all the readers and then back to a control panel. I've had minimal experience with this, but I've heard it's good stuff. Another question? Hotel locks are a whole other beast entirely. They are considered stand-alone devices, but on a device such as one of these, you would have a code that would be your code. On hotels, on the card itself, you're programming in times of dates of loud, not disallowed. So more or less when you have a card printer, it's printing on this room key, is for this room. It's for this date, to this date, at this time, to this time. And depending on which system you go with, it may or may not be protected in any way. On some of the older systems, you could just take a reader and rewrite that when this is allowed to, when that's not allowed to, and get access to hotels. But that's not too common anymore, having that vulnerability. What was that? One more? Okay, two more. You first, then you. Samelton happens to make some very good stuff, but they're just like any other company. I'm not going to say one is better than another, but they happen to have a person they like for some of their stuff. Yes, sir. Because they have a, in on that new card, it says, turn off the old cards. It's basically that there's a one-time session key.  It basically has a one-time session key that says, when this card is working, that's good, until there's a new card. That is valid. Once this new card is valid, all old cards stop working. See, I use a fancy computer word. I like that, session key. One for you, and then I got to keep going. Wait till I get there. I didn't see it. I will be getting there. I'll get there right now. What he's saying is that no matter how high the access control system gets with all kinds of fancy things, a lot of times people will put a key back up, a physical hardware key back up. Just in case the access system goes down. Now, this is a huge vulnerability if it's not done properly. The proper way to do it is on that key back up, it's got a double-pulled double-throw switch. One side throws an alarm, the other side releases the door, or there's a tamper switch that when it is done, you should definitely have some sort of a burglar alarm or a violation alarm go off when a key back up is used. I personally always back key back ups.  That's where you have to leave it. Shit does break. Key backs up are good, but protected properly, because anyone who can get access to the key back up can get access to your door. Hey, a photograph dude, cool. Okay, improperly designed systems. Putting the controller on the insecure side of the door. Okay, everyone's laughing, but screw you guys because I see this every day. For example, an IEI keypad, oh, I'm sorry, a brand-name keypad happens to have a relay on the back of it.  There's two wires. If you trace those wires, they go to the lock. So what do you do? Take the two flat-head screws out, pull the keypad off the wall, touch the wires together. Throw them locks. Put the keypad back on the door, they thank you, and go in. Controlling the wrong side of the door. Huge issue. See you all the time. Protecting only one of many entrances. Okay, the front door has this big fancy burglar alarm on it. It's got a card access system on it. The back door has got a big-ass bolt.  Okay, excuse me. I'm having a prop-to-door alarm.  I can walk through an open door no matter what you do. You got to close the door. Make sure you have a door closer on top that automatically will close it. On these access doors have a prop-to-door alarm that tells you if the door has been left open. It's very important in any real access system. And not instructing the employees of proper security protocols.  It really is bad. It really, it's not good. Make sure they don't let their buddy who forgot his card borrow the card because he probably just got fired yesterday and he's coming back to blow the place up. Just make sure your employee has no proper security protocols. Database server vulnerabilities. On these access control systems, all your logs in general are stored on your database server for the access system, which is then put onto the network for ease of use and is then forgotten about by the IT guy. What nobody ever remembers is it's a computer like anything else. The majority of these systems are now running on Windows platforms, which means that if Microsoft puts out a security patch, there's probably a reason. If this server doesn't have that security patch, there's probably a hole. And if some wily hacker inside the company decides he wants to rip off the 2,000 computers that just came in the shipment into the warehouse, he's going to go scan the network and map and... Find that server and just kill it. Wipe out all the logs. Take it down for the night. What's going to happen? You have no more log files. No one ever protects the server. It really, really is important. Easy duplication of credentials. Magstripe, we went into how you can do it with a VCR. Keep edge. You can look over the shoulder. Biometrics. There was a wonderful presentation about two years ago on how to clone most biometrics. I don't remember by who, but it was a great presentation. I'd suggest you go on the... I believe it was a Black Hat presentation. You can go on the Black Hat website and do a search for it. Easily circumvented credentials. Okay, this is one of the most interesting parts of my presentation I feel once you understand basically how an access system works. I'm a card reader. All I output is a number. It's used as a weekend protocol, which is not necessarily weekend card. It's the weekend protocol. He invented two things. He invented a nice guy. So it's outputting a bit stream here. You're going to be my door controller. Sit down. He's my door controller. All I do, I just scream yes and no. You'll figure out when. I sent through a card number to him. He recognized the card number. So I sent through one, two, three, four, five. He said yes, cool. Okay, I sent that through. I'm sent on a piece of wire. So here's what I do now. On that wire, halfway along, I clip it. I parallel those wires out to a second door controller as well as the first door controller. Now, in both of their log files, when I swipe that card the next day, I'm going to get yes and yes. Now, I have two people who both acknowledge the fact that the card reader was red. This one's not going anywhere. That one still works fine. But now this one has the log files. I come back at three o'clock in the morning, take this one home. I have the card numbers of everyone in the system now. Uh-oh. Uh-oh. It's good. Beard. He was the weakest type. Okay. So now this works. One second we'll get there. Now this works with the proximity card. So let's go to biometrics now. Put that same fingerprint reader on there. What's it spinning out? It's spinning out one, two, three, four, five when that finger is put. So, no matter what, he's still getting that same one, two, three, four, five. One attack will work against any of those. It's a huge vulnerability. No matter what type of security prevention device you're using, or access control fingerprint reader or card reader, they're all just outputting the same string. There are some technologies now that have fixed this problem. I'm not limited to say which, but they're out there very rarely and very under marketed. Excuse me. Boy, this beard is making me burp. Cool. One of the best ways to protect it against this is, one, tamper switches. On some of the larger access control systems, they actually have terminating resistors that it'll tell if the lines are paralleled off of. It's pretty rare, but it is used. Besides tamper switches, you also have a camera system, which you can simply watch to see if someone's cutting the wires. But we'll get there on the camera system section. How are we doing on time? I have 10 minutes. Okay, we're going to rush. I did an hour and a half of black hats, man. Okay. Here's an example of a proximity reader attack. Someone has a proxy card in their pocket. Let's say the president of the company, ABC, wannabe, whatever, Corp. You walk into the elevator with a maxi proxy reader, as I showed you in the briefcase, with a card reader. As you walk in, it scans the old card in the elevator. It can read through their pockets and everything else. You walk out, and now you've got their card numbers. Come back the next day with a regained out keypad. Take the reader off the wall, punch in the keypad number, okay. That's one. You had a real quick question. Still going or no? Yes. Where can we read up more? You can read up more on the Internet. Um... There's this place called Google. Also, I do have some references at the end of this, but you can all take. But there really is nowhere to read up on this. Honestly, as far as security vulnerabilities go, I've yet to find a resource on the Internet that goes through any of these. And I'll tell you all kinds of good stuff. Okay, we're going to have to bang through this. I know you can have my beer. Okay, that's one. Okay, defeating improperly installed locking devices. Crowbar. There we go. Okay, overview CCTV. We're going to bang through this one real fast. Real real fast. But I'm sure everyone will get this, because I'll go slower for them to understand. Cameras. They look like that. It's a camera. If you don't know what it is, go home. Camera formats. 330 lines is generally considered a low res. Medium is 380 to 420. High is 470 to 500. Multiplexers. Multiplexers take multiple cameras, put them onto one wire. That way you don't have... On older VCRs, you only had one input. It would multiplex the signal onto that one input. And then when you would... Mux and demux, when you would demux it, you would take those one input and make it many again. Usually you'd either use time division multiplexing, or low res, and then bring it back up when you need it. VTRs. It's a VCR that actually cuts the time up into smaller sections. DVRs. DVRs are an electronic version, a computer, basically, that replaces a VTR doing digital video recording. Now, these are basically the newest thing out there. This is what everyone's using. There's very few capture cards. That's the input boards for the computer being made. There's about six Korean companies. The Koreans pretty much have the hold on this marker right now. The Korean government is sponsoring their research into doing security work. I don't know if it's North or South Korea. I am hoping South, I'm assuming South. Okay, let's bang through this. Frame rate. The frame rate is how many frames per second the recorder is actually recording. What that means is, real live viewing, I'll use the number 30 for an example. In reality, it can vary, but real life is considered 30. You can see me fluidly, that's fine. Now, when I go into... I would want to do two frames a second, you'd see me like this. A robot from the 80s. Cool. Resolution. How does your picture look? You can figure that out. Compression. How compressed is the video? Hard drive space. I'm sure you can figure that out. Okay, that's just how much of the video do you actually want to store and how long can you store it for. What kind of feature set do you have? How am I doing on time? Nine past? We'll do one past, nine minutes left. We're going to run 30 seconds later anyway. Four camera VTR system looks like that. If your four camera is going to a multiplexer, multiplexer has one output wire, it goes to your VTR. I'm going to talk faster. Everyone's going to stay with me here too. The VTR, the VTR then stores all the data over that one channel. When you want to play it back, you take the VTR's output channel which goes to the multiplexer, which demoxers it goes to the monitor. Next one. Four camera DVR. Everyone have questions? Good.  Four camera DVR system. Same type of things.  Four cameras go in into the digital video recorder stores all the data. If you want to view it, you simply output to a monitor. If you want to do playback, you simply out to a monitor. All computer control. That's a high ten minute sign. What does it mean if you do this? Clap hands! Clap hands! You've known you guys because you couldn't see them. Okay. Four plus camera network system. This is more important. This is what you guys are going to run across. This is where you're going to have your problems. That's why I want to get to this part very quickly. We'll slow down in a moment. The internet cloud. I'm bad at trying clouds. Okay. On the right side, you have two DVRs in two separate locations. Each one's recording four cameras, let's say. What do you want to do? You want to view the material. Do you want to view it locally? You want to view it remotely? It doesn't matter. It's streaming through your CAT5 network. CAT5 to the internet, to the TCPIP, to the Homeboy G, all that. And the flow is through there. You can view it on the computer and check all that. Now this is how most DVR systems are being set up nowadays. Okay, improperly designed systems. Don't put cameras where it's dark if you're not going to put in any light. They don't work. There are some infrared cameras out there, but they're pretty rare unless you specifically order one. You're not going to get one. Be careful with lighting situations. In a room like this, if someone put one moving camera in the middle and went like this, they're only going to get a third of the room at a time, and they're going to be losing two-thirds all the rest of the time. You're much better off putting a fixed camera in each corner of the room. You'll get the whole room. Most people do that because they think it's going to save price by buying only one PTZ. One PTZ is equivalent to probably ten standard non-moving cameras in price. The only other difference is the fact that on the recorder now, you're taking up ten channels of data and ten times the amount of storage by having ten cameras instead of one PTZ. Record of vulnerability. This is what I want to get to. Digital records are hooked up onto your network. Protect them.  Most of these systems are Windows-based. Some of them are Linux-based now. Both of them suck. Fix them, dude. Okay. Vandalized cameras.  It happens. If it's going outside, make sure it's a vandal-proof housing. People do throw rocks and people do smack them. Network bandwidth. Here's a big one. Let's say I'm the guard at your company. I'm sitting down at my front lobby drinking beer on the job, of course. And I decide I want to check on the location in California. I click on California and bring up 16 streaming videos. Wonderful. Not too bad for my network bandwidth. Just sucking up all of it already. So then I click on Oklahoma, bring up 16 more. Now I'm watching 32 cameras. Then I click on New York, bring up 16 more cameras. Then I click on Texas, bring up 16 more cameras. I now have 64 streaming video signals. Am I getting high sign? No? No? Okay. 16 more cameras. So now I have 64 streaming video streams coming over my network. Your network is going to be in a lot of trouble if you have 64 streaming video signals flowing through. So I'd suggest putting network bandwidth limiters on these things and smacking the hell out of the guard who did that. Okay, network bandwidth we did. Covert video. Where are you allowed to put hidden cameras? Don't put hidden cameras. Why? Well, do put hidden cameras. Screw it. Jeff covered hidden cameras. Let's speak quickly. I'm going to drink. Well, hidden cameras are a very good idea. Can everybody hear me okay? Hidden cameras are a very good idea because people just don't know where they are. Somebody once told me they never worry about the cameras that they see and they only worry about the cameras that they don't see. And in a robbery that took place at the World Trade Center about nine years ago, a couple of guys went into one of the banks in there and walked out with about three million dollars in cash and suitcases. The guys all had masks on. The cameras were really not particularly helpful identifying these average height guys and average weight guys that had big black masks over their face and they just had the two eye holes. Then they took an elevator or a back stairway down to another floor, pulled their masks off and the covert cameras on the other hallways had pictures of all of these guys full frontal face shots. It was on the news and by the next day all these people's neighbors and people that knew them had identified them to the police and of course they've got another probably a good ten more years to serve on their sentences for armed robberies. So covert cameras are a very good thing. Okay, before we get any further, I love tradition and specifically my physical security talks which I've done a few of. I always get a hug from a girl on stage. So who wants to hug me?  Come on, hug me, see? I always get a hug. It's for good luck. Thank you. Okay, next slide here. Conclusion, look at that. I'll give you some links for you. Maybe four. We've been practicing this all day. I like to show King of the Hill and it made me think of a security demonstration. He's going to be our human access control panel in showing inventory control systems. Can you help me with this? Did you explain this? Okay, this is my purse. It has to be where I keep my cigars and my pipes and whatnot. He's going to play the access control system. This is going to be a man who is in there without an access card. Don't open it. Without an access card, but the purse itself is tagged with a security tag. Get up and go walk over there. Now, as the man without the access card walks through the door with the purse, stop right there, the door controller detects the purse. That's my purse. Then the door controller detects the person. At that point, the door controller concludes security measures. Now, that is my inventory control security demonstration, which we've been practicing. I pretty much had a time. King of the Hill, it's a great show. Bobby went to the women's training class and learned defense. Everybody go home and buy me more beers, please. Thank you very much.  Thanks very much. Anyone who needs security consulting anywhere in the U.S., give us a call.


Hi everyone, Joe for jaspyscasebreaks.com coming at you with a prism fast break break. This is random team number one And at the end we're gonna give away a $4,000 spot We're gonna take all the customers names Rerandomize them and the name on top gets a $4,000 three case National Treasures basketball spot pretty crazy Here's another crazy thing here. We're gonna help you increase your odds possibly of winning those spots We only sold 28 spots and we're giving away two spots That's nice, right? So let's grab everyone's all 28 names here. Did I make sure you grab the right list fast one? Okay So there's all the names there So there's gonna be three different dice rolls the one for the two-spot giveaways The one for the break itself and one and the third separate dice roll for the $4,000 spot giveaway. So this is for the two spots within the break that we're giving away All right, so let's roll it and let's randomize it Four and a one five times top two after five one two three four And a one fifth and final time So after five Now don't worry you everyone here.  So, you know, you won those spots. Let's copy all of that and Now We're gonna randomize you a team because we got to do the break itself first and Then the giveaway at the end. So a few some layers here, but we'll get there All right now for the names and teams one and a five six times one two three four five and Sixth and final time six times for the teams And sixth and final time. All right, no trade windows in these things. Here's the first half of the list right here And this is 2020-2021 So, hey, look at that Sean M with the Charlotte Hornets in this one Jason. You got the bucks Where the where the T wolves go Christopher Timberwolves So let's sort this by team and let's just print and rip this fast break box Good luck everybody fast break And I don't think we have to do too many more. Let me just look at my list here So this is fast break one And then sell a box to is after this and then I think Yeah, I think the two fillers that are on the site right now, that's it fast break to and team all two And that sells out the triple case break, which is huge. Thank you You should be able to get that in tonight plus a couple more pick your teams. All right. Good luck everybody So while we're breaking this I would advise everybody to get into the final two fillers here The the next fast break break has 24 spots left in that team all box only has six left And we're just those two things away from unlocking the triple case break Which we should be able to do tonight Pick your team three is sold out But we just need to get that pesky number block out of the way eight of ten spots left And we should be able to get pick your team three and the triple case break done tonight and more Case pick your team four five six. So keep going folks. Jasper's case breaks calm. I appreciate it. Thank you very much All right, we got precious achua so the fast break those uh, and here Spencer din Whitty Nets So that'll be for Alan. Oh nice to meet you confirmed All right now we just have to do the 24 spots left in fast break number two There's Jared Culver red disco to 125 All it takes is one ladies and gentlemen. I Know a lot of people have bought Big chunks of spots, and I know that's not what they want to hear but Hey, all it takes is one May as well give it a shot PJ Washington to 175 There's Dennis Schroeder two out of 20. He ended up with the Celtics. Oh, Nick. So we have different plans Well, let's see what sold out first then did you sell something else out, Nick? And you're not gonna be popular here Nick Stover. Yeah, we don't do any cheating here Hollywood Let's not even put that in people's heads We're all in the up and up here. I like these prism retros here in that disco parallel There's Shabazz Napier to 75 All right Quick little fast break box done now Let's go back here And let's see who's gonna win that spot So new dice roll new list Let's roll it and randomize it two and a five two and a three five times Name on top is in the triple case break Kind of nervous for you two and a three five times. Good luck everybody one two three four and fifth and final time after five 29 sad sad people but one really really happy person and that's gonna be oh sorry Louis It's gonna be Jason fracter Jason congrats to you. Thanks for getting in and we'll see you for that triple case break a little bit late tonight. Jasper's case breaks calm Bye-bye


Hey there lads and ladies, it is Petrifying Pumpkins here and I am back with a firewall zero hour video. Now this video is going to be all about the contractors of firewall zero hour, kind of going to be ranking them in order of most useful to least useful, as well as maybe doing a little bit of a discussion of what could be done to make the less useful characters a bit more useful, a bit more appealing. Now let me put a disclaimer here at the beginning, I'm a big firewall zero hour fan of course, but I wouldn't consider myself a high level firewall player. I'm not in the top 100s on the leaderboard or whatever so I'm going into this video through that kind of lens so maybe I'll incorrectly label a contractor here that has some potential in the right hands that maybe I don't see. So this list is by no means definitive and in fact I'm hoping you lads and ladies will chime in in the comments with your own thoughts on the subject. One other thing I should say before we start is that there is another contractor on the way coming up in DLC number two and I considered holding off doing this video until she's arrived but that could be weeks away and when she arrives I might just make a video focus on her and specifically and we can talk about how useful she is then. Okay so let's jump right in. So I'm going to give a rank of S, A, B and C tier to each contractor, S being the best tier, C being the worst. The embedded skill of each contractor is what really differentiates one contractor from another so that will be the main basis for this ranking, not what they look like, not their background stories or anything like that as that doesn't really affect gameplay at all. I'll go through these in the same order they appear in the contractor selection screen so that means we are starting with Okoro the Angolian contractor. Okay so Okoro's embedded skill is heavy juicy and that allows him to take extra damage from all explosives.  I found that as the weeks have gone on more and more people are using C4, grenade launchers and the instant karma perk which allows you to drop a mine on yourself when you're down or when you die and as a result Okoro is becoming more and more useful I think. If you give Okoro the bullet sponge skill as a secondary you pretty much have a tank type character, if you give him double time as a secondary then you've got yourself an effective kind of vanguard that can rush the enemy and maybe cause them to blow a C4 or a mine while he still survives and clears a bit of a path for his teammates which may be most useful on a map like shoothouse as an attacker as shoothouse often involves lots of C4 and grenade barrages thanks to its layout. Now I was expecting to put Okoro in the A tier but after putting some more thoughts into it and as seen as the game has developed more and more and thinking about how the Mesa has evolved around C4, grenade launchers and instant karma I think I'm actually going to put Okoro in the S tier. Next up we've got Raha the afghan lady with the scarred face, her skill is called scout and what this does is it gives Raha heightened enemy detection. This does two things, first thing is that it makes enemy footsteps louder to the player which is pretty nice but the second and most important thing is that it lets you actually see the enemies on your wrist tablets as red dots as long as those enemies are within a certain range of Raha I believe it's something like 5 to 10 foot radius or something like that and it works through walls. Now I believe this makes Raha one of the best contractors in the game especially on defense and especially when paired with C4. What you can do as Raha is you toss up a C4 or have a teammate throw up a C4 on a door and then just stand near the door until you see a red dots approach the door then you just detonate your C4 or give the signal to your teammates to detonate their C4 and you've got yourself a relatively easy kill. Her scout skill is very useful on the smaller maps in particular or maps with lots of rooms for enemies to hide in like hotel throw heavy juicy on Raha as a secondary to increase your likelihood of surviving your own C4 blast to make her even more effective as a defender and if big if the new contractor brings with her a skill that allows you to carry a second C4 then that would go quite nicely with Raha too. Raha is an easy S tier contractor in my opinion. Moving on we have the Australian contractor called Skip. Now Skip's embedded skill is called loaded this allows him to carry an extra magazine of ammo for both his primary and secondary weapons. To understand how useful Skip is you should ask yourself do I often find myself running out of ammo in this game? For me the answer is not really. Now there have been some occasions where a match has like gone down to the wire and I've gotten myself in some really intense gunfights with equally matched enemies where I have run out of ammo but that's not very often plus there are ammo boxes gathered around every map that can make it fairly easy to resupply plus most people are using revive pistols as their secondary which is not affected by Skip's ability at all making him even less useful but before I write Skip off entirely I would say he is very useful for solo and co-op modes where you have wave after wave of enemies and you usually will actually run out of ammo so Skip is actually my main when I'm doing solo or co-op. No matter if I'm attacking or defending but that may not matter to you if you only care about PvP so I'm going to rank Skip as a B to your character but what could first contact do to make Skip more appealing? I think it might be no harm for them to get rid of the ammo boxes on the maps maybe leave them in solo and co-op only and also maybe nerf the ammo resupply bag I know if they did both of those things it would give me pause to think about actually selecting Skip in PvP. First up is the lovely Mako from Japan now her embedded skill is called Ninja and it reduces her movement noise making her this stealthy one of the group. You might often see Mako being picked as an attacker especially when she is combined with something like double time allowing her to silently rush or flank the enemy defenders at the start of a round combined with silenced weapons or a knife and in the right hands she can wreak absolute havoc but I feel like there's a bit of a skill barrier to use in her. To use her well you need to have a good map knowledge as well as good knowledge of spawn points for laptops and stuff like that. Not to mention you'd need nerves of steel if you plan on doing silent knife kills. Now I asked my pal Jermvorf whether Mako's Ninja skill makes her invisible on Raha's map as I don't often use Mako and he does. He told me that it seems to help against Raha's ability to hear footsteps louder but Mako will still show up on Raha's map. Thank you very much Jermvorf for that info. So Mako is somewhat of a foil to Raha's scout ability but not completely. I'm finding it quite hard to place Mako in the tiers. I think she's borderline S tier but I think I'll put her in A tier. So why not S tier? Well I think if she was invisible to Raha's scout skill entirely that would push her into S tier territory and make her generally excellent rather than only excellent with specific but somewhat limited tactics like rush and flanking. Next up we have Fang the Chinese contractor. So Fang's skill is called Lightspeed and it allows him to reload magazines faster. I feel like Fang is one of the least useful contractors in the game. I very rarely see him in PvP I never pick on myself simply because the standard speed for reloading weapons is pretty good as it is.  But those moments are few and fair between and I'd rather pick more useful skills and risk that happening than pick Fang. I will say that, like Skip, Fang could be quite useful in solo and co-op especially when combined with Skip's loaded skill as you'll be doing a lot of reloading in that mode but still I think I have to put Fang in the B tier. But what could first contact do to make Fang more appealing? This is a tough one but to keep it focused on reloading I think they could maybe slow reloading down for every other contractor and not only that but maybe make it so that Fang has extended magazine capacity even more so than the actual attachment for extended magazines. That would certainly make him more appealing in my eyes and bump him up a tier or two. Next up we have Red the Russian. His skill is called Bang Bang and allows him to carry an extra frag grenade.  I feel like he is better suited to attacking rather than defending especially on a map like shoot house where you can see where the defenders are holed up and then just rain down frags none like artillery strikes. The downside of Red is that if he wasted that third and final frag then what was the point? That's less likely to happen in the hands of a skilled player but still that's why I think Red is an A tier contractor. Now what would push him into the S tier? Maybe if he carried an extra impact and sticky grenade too instead of just frag grenades only but as it stands he's a solid option and he has a big fun factor to him. Red is the British contractor Grimm and his embedded skill is called Quick Fix which reduces the time it takes to revive a downed teammate, giving him a bit of a medic vibe but how useful is Grimm. Now in my opinion he's not very useful at all, yes there have been times when I've died while reviving a teammate but it's very similar to Fang, these moments aren't frequent enough where I'd sacrifice a more useful skill for Grimm. Not to mention he's completely useless for solo play. For these reasons I'd put him all the way down in the C tier. Now what could first contact do to get me to pick Grimm? While there is a skill in the game that you unlock at a fairly high level that gives you a revive pistol 3 shots instead of 2, I can't help but feel like that should have been Grimm's skill, thus or maybe the ability to revive himself once per match from a downed stays. Either of those things would make Grimm much more appealing in my opinion and put him at least in the A tier. Terek or Tariq I'm not sure how he pronounces, the Syrian is next. His skill, wired, allows him to see enemy traps at a grazer distance. Terek is another one of the less useful contractors I believe. Ok, so I can see mines easier but wouldn't I rather pick Ghost which means I don't set off mines at all. That way I don't even need to see them. Because of this it feels like Terek is stuck with a bit of a dud skill and this is why I put him down with Grimm in the C tier. Now what would make Terek better in my opinion? Well maybe expand his wired ability to help him track down signal jammers more easily. Now signal jammers may not be as prevalent as they were a month ago but they can still catch you out from time to time so if Terek has this ability it would probably be worth it to bring at least one Terek on your team as an attacker. But that might only bring him up to B tier seen as it's only good as an attacker. So what if we get out Terek another buff against enemy traps? Perhaps mines take longer to explode when triggered by Terek. Maybe let him defuse a C4 by holding X on us if he's feeling brave enough. Stuff like that would bring him up a loss in my opinion. Texas from Texas is up next and her ability is called bullet sponge. This is probably one of the most beginner friendly of the contractors. Her skill lets her absorb more bullets, it's fairly straightforward. Although when tested it doesn't seem to apply to the head. But still, more often than not she can keep you alive a bit longer. Now how effective her skill is seems to be up for debate. Me and some of my subscribers did some testing in the past but we only used the beginner pistol. I believe we found that she was able to take something like 5 extra pistol shots But that was with a very weak pistol. With more powerful weapons that might translate into only an extra bullet maybe 2. But in a one on one situation that might normally result in a kill trade, Texas can give you the edge you need. And those situations are more occasional than you think. Because of this, I'd put Texas in the A tier. She'll help you get to grips with the game and combined with heavy juicy she can be a bit of a tank. You can add Ninja as an attacker and she'll have a good chance of taking out any stragglers on the enemy team who have been separated from the herd. Odin from Norway is up next and Odin brings with him the Iceman skill. This skill gives him reduced weapon recoil when firing his weapon. Odin is a bit of a mixed bag because of this. I say this because as an experienced firewall player you can learn to deal with recoil yourself. You can get a feel for your weapon and as a result you might not even need Iceman. But as a less experienced player or if you're thinking of trying out a new weapon and don't know what kind of kickback to expect, Odin could be a useful choice. I'd have to put Odin in the B tier because of this. Now what could bump him up a tier? Well, maybe decrease his weapon recoil even further while he's crouched or something like that. Or maybe less Odin see a red glow on the enemy's head, drawing the eye there and making accurate headshots easier to pull off. That could bump him up to an S tier in my opinion. Next up we have Diaz with his double time skill allowing him to run faster than any other operator. Quite a useful skill when complimented with the right secondary skill. Ninja, Ghost, Bullet Sponge and Heavy Doosy are all smart choices to apply to Diaz although I will say he is probably better suited to attacking than defending especially if you like to rush the defenders. I'd give Diaz a spass in the A tier seeing as he goes well with many of the other skills. Last but not least we have Nala. Nala comes equipped with the Ghost skill. The Ghost skill allows her to run past enemy mines without setting them off, making her a great choice for an attacking contractor and a great foil against the instant karma perk. Some people might tell you that Nala isn't as useful anymore because less people are using mines because too many people are running ghost for them to be effective but when you stop running ghost those mines will just come back and you'll be sorry you didn't have ghost. It's a bit of a chicken and egg scenario kind of but with instant karma still being on the rise I still think ghost is worth it and it's always good to have at least one attacker with ghost so that they can sweep the laptop room without setting off any of the mines that are usually set up there.  Combine Nala with double time or ninja and you have a grace attacking option that can get that laptop hacked. And there you have it. This is my final tier list for Firewall Zero Hour. Well, until the new operator releases anyway. Again, this is all based on my own opinion. I'd love to know which picks you agree with, which ones you don't agree with or which ones you'd move up and which ones you'd move down and the reasons behind that. So let me know all that stuff in the comments below. One final thing I want to say before I end this video is that I want to extend my best wishes to all the folks over at First Contact Entertainment and to all their families and friends. I know there have been some crazy fires over there in that part of the world and I hope it hasn't affected them badly. My thoughts are with you guys. So that's it for this video, lads and ladies. If you enjoy this video and want to see me make more Firewall and PSVR content, then please consider doing all the usual shies. Thank you very much for watching and I'll see you in the next one. Bye for now.


All right, so I'm going to start talking about projects at the tail of the spectrum that start to get further and further away from ENCODE, beginning with phantom, which is a long-run consortium, the functional annotation of the mammalian genome. It has a goal that is in some ways quite similar to that of ENCODE, really focusing on identifying functional elements in mammals. They're looking in a variety of human and mouse tissues and cell types, and so they tend to be quite broad on the sample diversity axis. Unlike ENCODE, they're very highly focused in the assay dimension. A great deal of the data that they generate is CAGE data, cap analysis of gene expression, where they can locate the endpoints of RNAs, and they couple that to a limited extent with transcriptomic data. So all phantom data is available at a public repository. Another resource that phantom provides is a CDNA clone bank. So they have clones of many of the full-length CDNAs that they've identified over the course of their project. And there is a coordinated data analysis and integration effort. This focuses to a large extent on functional element annotation, using their CAGE data to identify both promoters looking at mRNAs, as well as enhancers using their data to map enhancer RNAs. They've also taken a foray into examining different cell states and fates, and they have also done some work looking specifically at mechanisms of gene expression. Phantom is funded by Wright, and I should point out. So really the key feature of phantom, as I was considering it, is that they'd have this very, very narrow focus on a particular assay, the CAGE assay, but then that allows them a lot of latitude to move through some of the other dimensions, particularly the dimension of sample diversity, looking at a large number of cell types and tissues, as well as doing some nice work looking at different cell states and fates, biological and chemical perturbations of cells and tissues, and coupling that with time-resolved data collection. I'm going to move on now to talk about GTEX, the Genotype Tissue Expression Program. This is funded by the NIH Common Fund, and the goal of GTEX is to provide an atlas of gene expression across human tissues, and really to provide a resource for exploring how this gene expression is modulated by genetic variation. So GTEX is looking at a pretty broad swath of human tissues, up to 30, and looking at this within a large number of donors, so up to 900 by the time the project is complete. They're collecting a number of data types, transcriptomic, as well as whole genome sequencing and whole exome sequencing. There is another effort associated with GTEX, the EGTEX or enhanced GTEX, where they're looking at a much smaller number of donors, but applying a larger number of assays across those donors, including epigenomic and proteomic assays. Additionally, I should mention that there is very recently been established a collaboration between ENCODE and GTEX, where a handful of donors will have these assays and code assays performed on this broad variety of tissues. GTEX data is primarily restricted access, and it can be approached through the GTEX data portal and available in DVGap, with the exception of the ENCODE-GTEX collaboration and all that data is to be open access. They also have a very nice data analysis feature in EQTL browser present at their portal. So I think the really distinguishing factor or feature of GTEX is the large sample size. Looking at several hundred individuals really allows them to delve more deeply into inter-individual variation than some of the other projects that are being considered. And then they couple this with very high tissue diversity. To do this necessitates that they focus more tightly on the set of assays that they use, but together this provides a really great set of resources, I think, for starting to understand how inter-individual variation impacts gene expression. Next I'm going to talk about the LINX program. This is another common fund program. It stands for Library of Integrated Network-Based Cellular Signatures. I have to look at that every time I say it. The goal of LINX is to create a network-based understanding of biology by elucidating cellular signatures as they refer to them through systematic perturbation of systems, data collection, and then a computational analysis component to extract these cellular signatures from the data they collect. They are looking fairly deep in the tissue and sample dimension, looking at a number of primary cells, cell lines, IPS cells, and differentiated cardiomyocytes and neurons, collecting a number of different types of data, transcriptomic, phosphoproteomic, epigenomic, and imaging, so a wide range of molecular and cellular phenotypes, and it should be pointed out that they're not looking at all of these assays in all of the different samples they look at, so the LINX data cube, as it were, is not uniformly dense. There will be a very deep number of assays in certain cell types, but not in others. Their data is available at the LINX data portal, and a distinguishing feature of LINX is that there really is a concerted integration and data analysis effort aimed at deriving these cellular signatures. These will be queryable, are queryable, and available online at the LINX portal. And they're also generating tools so that community data sets can be used to inform about additional cellular signatures. So LINX has really gone very deeply into the dimension of cell-state fate diversity. They have a uniform library of what they refer to as perturbogens. These are biological or chemical stimuli that they can approach various samples with, and they're also doing time-resolved data collection for some of these perturbations. So I think we've heard in a couple of the talks already a mention that there's not been a lot of movement into the direction of examining cells in either resting states or perturbed states, and LINX is really pushing hard in this dimension. Another feature of LINX that I think is worth pointing out is they have a strategy to initially look at a large number of assays, but then analyze data and consider which assays are the most information-rich, and then rationally hone in on this set of assays so they can get the most information, but then apply that to the largest cell, state, and fate space or look at lots of different types of samples. And that's important because they have this high sample diversity focusing in this way will allow them to approach many different cell states and fates. Next up is a very well-known resource, the Cancer Genome Atlas. The goal of the Cancer Genome Atlas is to improve cancer care by accelerating the understanding of the molecular basis of cancer through genomics techniques. This is funded jointly by NCI and NHGRI. They have a very large sample set, 10,000 matched tumor and normal pairs, and for many tumor types, they have several hundred tumor normal pairs that can be compared. Collecting again a variety of data types, primarily whole genome sequencing and whole exome sequencing as well as transcriptomic data and more limited epigenomic and proteomic data. So some TCGA data is open access, other is restricted access. It can all be approached through the TCGA data portal and the restricted access data is available in sort of the TCGA equivalent of DVGAP, which is known as CG Hub. TCGA is a member of the International Cancer Genome Consortium, ICGC. And this has an overlapping and similar goal to TCGA. And here they're trying to obtain a comprehensive description of changes that occur in 50 tumor types that have been determined to be of very high relevance, genomic changes as well as transcriptomic and epigenomic changes. Like TCGA, they have matched tumor and normal samples and collect several data types that are similar to those being collected in TCGA. Also like TCGA, they have both open and restricted access data that can be obtained through the ICGC data portal. And finally, I'm going to finish by talking about a project that is fairly distant related to the rest of these, but it provides sort of a unique resource and so we thought that it was worth mentioning here. This is the Knockout Mouse Phenotyping Program, or COMP2. This is a common fund initiative as well, and the goal here is to provide a broad set of standard phenotyping assays over a genome-wide collection of mouse knockouts. They're a member of the IMPC, the International Mouse Phenotyping Consortium, collect data types that are pretty distinct from everything else we've been talking about, morphological data, histopathological as well as a number of behavioral assays. And COMP2 data can be accessed through the mousephenotype.org data repository. So we briefly run through many different, very large programs, and we had to do this at a very high level. And now we're going to take a step back to an even higher level for just a second and consider all of these in aggregate. So I've listed them all here, and next to several different ways that they can be differentiated. Obviously, there are many, many different ways. You could draw distinctions between these projects, but we thought this might be a few particularly interesting things to look at. So in terms of assay diversity, several projects have gone quite deep into looking at a number of different assays, and many projects actually have gone very deep in the sample diversity space, so looking at a large variety of tissues, cell types, and cell lines. I think it's notable that the dimension of looking at a large number of individual samples is, at least at this very, very rough view, rather poorly explored at this point. GTECS, TCGA, and I guess PsychonCode I neglected to mention, have significant numbers of samples where they can start to address questions about inter-individual variation, but it seems that there is still a lot of work to be done in that area. And finally, again, a smaller number of projects have looked at this dimension of cell perturbations, looking at different combinations of cell states and fates, and how functional genomics characteristics change over time courses of differentiation and things along those lines. So I'm going to wrap up by considering one final dimension, and that is looking at these in terms of the topics we're considering in this workshop, those of unbiased mapping or annotation, supporting basic biological studies, and supporting more disease-focused studies. And so these categories blur together a lot, I think, as we'll hear about over the next day, and this is a very, very rough approximation, but we wanted to sort of, and I should credit Mike Payzen for putting together this slide as well. We wanted to take a look at these and see whether there were particular areas that were considering in this workshop that had a large excess of effort, I'm not sure there can be an excess of effort, concentration of effort at the expense of some of the other areas. And so, to me, the take home from this was really that there is a lot of work going on in each of these areas, and that there's really a broad base of functional genomics research taking place at this time. I think that gives us a really good jumping off point for the types of things we're going to consider throughout the rest of the workshop. So I will wrap up there, and if anyone has any questions for myself or any of the other presenters, I'm happy to take those now. What is FunVar? You didn't mention that. FunVar is the functional... So I apologize for that naming. FunVar is a new project, and it's the... This is the project I referred to as the computational prediction of the significance of non-coding variants, and in-house we refer to it as FunVar, and it doesn't have a real name yet, and so on. Some of the materials, it's FunVar. Question. Do you have... So with all these projects that are in production and have been for a number of years, is there a good assessment of the cost per assay experiment? Right? I mean, that would be really interesting because you have a number of large-scale projects that are doing very similar types of experiments, right? They're doing chips, you know, epigenomics. Yeah, I don't know that we've compared that across projects. I'm not aware of us having tried that from ENCODE, for example. I mean, in-house we know about the cost of ENCODE. The cost per experiment is a little more difficult to say because, I mean, some of our costs are the data coordinating center, analysis of the data, and so forth. I mean, you're primarily interested in whether the costs vary across project or just how much doing this kind of stuff costs. Oh, per project. I mean, it would be interesting. I was thinking about the genomic experiment would be to ask each of the projects, hey, I have an interesting cell type. I'd like to run it through your assays how much would it cost me, right? It's more general. I mean, you know, there's all kinds of great stuff that's infrastructure and I'm not really, I'm not quibbling about the cost of the project. We know what those are. We can assess them. It's just more down in the mechanics, in the weeds, right? You have these, you know, and I'm asking, this is a taxpayer. I see the sense of your question. I can't give you a simple answer that, you know, standard six histone marks and whole genome by cell fight and RNA and DNAs would cost X number of dollars. One of the vagaries of this depends on the sample type, okay? So like with cell line, the cost is relatively fixed.  That's not limiting. But getting large amounts of cells, ES cells differentiated by a company is hugely expensive. Getting consents for open access data costs a lot of money. Hooking up with clinical partners to get sample access. So in some cases, that part of the step is quite expensive and depending on what the sample is can hugely change the price. So can I just follow up on that question, sort of bringing into this what Lynx has done, where they've sort of started out with generating a lot of data and then trying to funnel it down to which are the data sets that actually tell us the most. It seems to me like that is sort of a clever strategy and something that ENCODE could build on based on the fact that there's a tremendous amount of information for certain cell types, but not all of it is probably deemed equally useful. Not all transcription factor antibodies work equally well, et cetera, et cetera. So is there an interest in ENCODE basically to do something like funneling down the data sets that are would be necessary if we move to different cell types, systems, perturbations, et cetera? Maybe a conjecture. Can I? We'll talk about this in a little bit. We will? OK, so I'll say briefly, yes, that this is of interest to the project. One of the things to keep in mind is part of the utility of the data depends on what it is that somebody is going to do. For instance, you heard from Mike Snyder's presentation, we have a small ENCODE has a small number of cell types with a very large number of assays. And certain kinds of work require that. There are people that say, I want to analyze 80 different TFs in the same cell type. So that's what matters to them. And other users of ENCODE data are saying, I want to know which enhancers might be important in which cell types and disease. What matters to them is that we have profiled many different cell types with the same assay. So then those people will say, well, I want to look at DNAs or RNA, where ENCODE has this in many, many cell types. So part of it is a trade-off issue. It depends on what you want to do with the data. Yeah, and there are two things that have been coming up in the talks, and I wanted to bring those out a little more. So one of the things that you might want to do with the data is to keep it interoperable and combine data from these different groups. And I'm glad that there's a growing awareness of the need for good metadata. What's hard to keep track of is this key distinction. Some of these projects produce data that's open access, and some of it's restricted access. And that's a critical dimension that we've got to keep in mind as we think about how best to not only interact with these groups, but how much of the data could be put into a common fund of data that really could expand to a larger encyclopedia. Thanks for that point. And as we move through this workshop and we think about implementation, I would like it for people to remember to comment on some point to what extent should we be spending our dollars on getting more assays, to what extent should we be spending our dollars making sure that the data are unrestricted access. We can't do everything, but this is an important point to consider. What is the relative value of unrestricted access versus controlled access data? Can I comment on that for a moment? The restricted access obviously is needed when you're talking about using samples from patients, right? But I would just like to remind you of earlier that the use of raw data was very, very minimal in the ENCODE project. And that is the data that will be restricted, and you can gain access, but it is restricted in the sense of openness. But it's used very, very infrequently, very rarely. And so I don't think it's a major problem. Well, I think we have to keep track of it. So I mean, I certainly understand your point. That's a good point. And I know that Blueprint and others are making some process data. And that's what you can get from GTECs if you go to their portal is a processed version. But we really have to keep in mind the levels of access and levels of access to which level of data. Yeah, so I think we need to move to the next session. I'm not trying to like the idea of having more discussion. Perhaps the comments or questions that we didn't get to come up in another session. Thank you.