Hey there, it's Robert Baltadano. Welcome to another show of talks from the heart with Pastor David Rosales, and I'm hosting this program And it's always exciting to have you tuned in or if you're watching on our YouTube channel Welcome, and we have a great topic for you today that we're gonna be discussing this time We're gonna be talking about God in America and Pastor David again welcome. It's good to be here Yes, it is it's always exciting to have these talks with you It's it's a good thing because we tend we get to to really talk about things that do matter I think so I enjoy these kinds of conversations very much. So so today we're gonna talk about God in America I know that's such a huge topic, but but before we really get into that specific topic I want to talk a little bit about human history the history of mankind and and what God intended for for people that he created on this earth so if we go back to the creation of time obviously passing through You know the creation of Adam and Eve We realized that something happened there in the garden that that caused the downfall of mankind sin came into the world and from that Point forward man became rebellious against God now Here's the thing that I wanted to talk to you a little bit about God's intention was for a theocracy Correct. Yes, and what does that mean? That means that God's ruling that God was to be the center of all things that man was commanded to Simply obey him because he's the king of the universe and so God's intent Was for man to live in fellowship with him being blessed and provided for by him and all of that but Man was not to be the ruler. He had dominion. He had been given authority in certain kinds of duties that he was to perform but that was all to be under God's supervision in That God is the sovereign creator of the entire universe and so God's intent as it seems to be expressed in scripture was for man to be having a relationship with him and a relationship with the creation as The one who was the premier creation of God Vested with authority to enact upon the earth that that man was to inhabit it but because sin entered in through the deceptive purposes of Satan and Eve took of that forbidden fruit gave to her husband and he ate also Sin was introduced at that point and so man's Relationship with God which had at that time been unsullied by anything called sin at that time Man because he sinned broke fellowship with God and that's where the whole redemption history begins and so Besides Cain and Abel and that whole situation there. We see that When God created this world and the people on this world like us obviously We start to see the the decay of of mankind and there's a verse that comes to my mind And it's in Genesis chapter 6 verse 5 when we really begin to see The downfall of just society and it says this then the Lord saw the wickedness of man He said he was great in the earth that every intent of the thoughts of his heart was only evil continually now that's interesting because I don't know about you But but but it shows me from this verse that the issues that we have in our society today are not really political They're more heart issues. Don't you think the issues of the heart? Absolutely There's no doubt about it because from the abundance of the heart words spring and actions spring You know Jesus was speaking concerning that in the gospel of Mark 7 And he said it's it's not the outside that is polluted It's the inside because out of the heart proceed the wicked thoughts and the adulteries and the murders, etc So it's always been a matter of nature human nature And so indeed what it is is we simply see the visual expression of the internal condition and so Man being sinful in in in the fact that we have inherited the ademic nature the one that is prone to rebellion against God Then even the best that we can do as human beings is always going to be tainted by the self-interest and the things that proceed from a sin nature and So it all begins from within the heart of man And so after that we also see other things that are beginning to take place that took place in the beginning of time And one is the Genesis 11 the Tower of Babel. Yes, I mean now now we're getting into something more serious You know God sees the heart of man is continually evil, but now The people that got created who were you know one language and all of that now they're building this tower Why is it that that man has this this this desire to want to be above God to want to rule themselves And in the Tower of Babel if you want to talk a bit about that what went on there? Well human nature being what it is is in constant rebellion against God and thus because we've been created to worship We have a few options that we can exercise we can we can truly worship that the God of the universe We have that provided through redemption. We have that We are given opportunity to do that through the conviction of the Holy Spirit And today with the revelation of the word of God that instructs us how that can take place And so we are prone to worship even atheists those who profess. There's no God Find something to worship whether it's themselves or whether it's nature or whether it be some art form Some literature of some sort whatever they're going to find something To invest their attention and their adoration on we simply are created in that way We have been created with a sense of needing purpose and even as the writer Ecclesi of Ecclesiasties Points out God has placed eternity in our heart. There's an awareness that that we have a Time-space Continuum that we exist in and we need to fill that up with something that Satisfies or gives to us purpose. I mean that's just a fact and so we have the opportunity to have relationship with God because it reveals to us these things in Scripture but man is going to find something to worship something to do and often when it's Through man's invention. It's going to be the opposite of what God would intend So when you see that the the thoughts of man are only evil continually They ultimately express themselves those thoughts in in a form of worship and so at that tower there in Babel They Intended to chart their own destiny or their set their own course not not alone in the sense of they Them doing it from some intrinsic or something that came from simply within but they look at the heavens and as they looked at the heavens They began to try to chart their course or their their destiny through the natural revelation J. Vernon McGee says that the Tower of Babylon was Possibly an altar of some form to worship the Sun, you know in in his perspective There's some some credence to that in that the the Sun separates the darkness by providing light And so he moved in that direction and said that you know There are others that would say that this Tower of Babel that was built was in order not to to reach into heaven in the sense of finding some way of Going into the throne room of God but in reality to To chart the astrological signs so that they could use the stars the heavens as their their directives if you will and it all goes back to Romans 1 where Paul says that they began to worship the creation Rather than the Creator and so when man determines that they don't want to Subscribe to and yield to the directives of God because we are intrinsically religious We will find another form and the Tower of Babel is that form where they said let us So they united in rebellious effort with one language and one purpose To reject the revelation of God and to chart their own course through it appears at least and I think this is correct through the Realization of nature as their their form of directive if you will and so the Tower of Babel represents the rebellion of man Rejecting the sovereignty of God the orders of God Remember also that God had said you are to be fruitful and multiply and replenish the earth yet. They said We need to remain together here lest we be scattered and So that was a complete rebellion and rejection of the ways of God Based on the human nature that resists yielding to any authority They united together in a single effort and as a result of that They began to look to the heavens to chart their own destinies looking to creation rather than the Creator and Ultimately God confuses their language and this is something that they didn't do on their own This was from that the leadership of Nimrod this that you know evil very often will find a captain Yeah, you know and so there is one who unifies Purposes and very often you know well the scripture speaks concerning the unity I mean one of the one of the the powerful things that we find in there that that we may want to address for just a Moment is that language is the great unifier when you speak the same language it unifies you and secondly When you have an evil purpose there are those who can communicate the evil purpose in that language Which unites them in rebellion and that's what took place with Nimrod That's what took place with the unification of humanity and that's one of the reasons why God scattered them by dividing them according to Languages and forced them to unite with those who they could communicate with and actually broke that problem down into smaller subsets So going back to the whole theocracy when we talked about this at the beginning God wanted one nation under God and as you look at the history of the children of Israel You know it started as a theocracy then it went to a monarchy then an anarchy In you look in the book of Judges, so you see a progression, but but it's more of a decline Obviously God wanted that theocracy They kind of did not go with that and then God gave them kings and they even rejected their kings And then it eventually became to every man did what was right in their own eyes, which is a scary thought So that the children of Israel were led by God in a very very unique way And when you read the scriptures in the Old Testament, I I'm always just I guess blown away with the way God did Among them, you know manna from heaven and you know I let him in the in the daytime with the pillar of cloud of fire and night and and all these wonderful things God Showing that I want to lead you. I want to I want you to be fruitful and yet the children of Israel became so rebellious Why do you think they were so set against God's leadership? Man's nature is rebellion authority We are we have within us a rebellious spirit that is is is very often and most often Revealed by a rejection of simple authority. Yeah, I drive to to our offices and In my neighborhood, there there are very few Police officers that patrol. I mean they just don't they do show up and it's you know, they're just not there all the time So I have a series of stop signs that I have to take before I get to a signal and I tell you 9 out of 10 easily 9 out of 10 people just drive right through it I mean, it's not that they some of them just keep going 45 miles an hour and just shoot right through it There's no police officer around. There's nobody gonna say anything or they'll just roll right through the stop sign constantly You see that now. I'm thinking that there's gonna be a day coming and it's really not that far From now where people are gonna run red lights in the same way they're running stop signs because it's more a matter of like I don't see anybody there. There were no cars there. So we are a rule into ourselves. We're making laws into ourselves You know, we're saying this is okay for me because I looked at the situation There was no car there that was pulling up. There are no vehicles around Why should I stop and that's that is so simple, but that is so real I mean, it's just the scripture says that rebellion is tied up in the heart of a child We rebel by nature. So if I say this is black, they say it's white if I say this is sweet They say it's sour and Isaiah points that out. He says you have a tendency of Rejecting because your sin nature is so polluted and you're so naturally rebellious Even God himself is rejected even his word itself is called into question And sometimes even his word is called into question by those who profess to know him I mean, you know this and I know this that the higher critics from the 1800s the Germans Especially who represented higher criticism, you know, one of the first things they did and they polluted the church with was calling into question The manuscripts of scripture the authenticity of the word of God They began to create multiple authors for books like Like the book of Daniel divided as they did or the book of Isaiah and the way that they did by by saying that These really are not authentic manuscripts. These really are not God's word itself. This is really just Containing the word of God and all of that philosophy that has infiltrated and saturated the mentality of many scholars and Many Bible colleges came with a simple rejection that came all the way from the garden When Satan said has God said and even recently I was sharing with our church And I said listen if you can believe the first few words of the Bible in the beginning God You can believe the rest of scripture But if you want to reject just the first four words of the scriptures, then you're gonna reject the rest You're gonna find places there to reject Look at the doctrine of resurrection For example the doctrine of resurrection that we find alluded to in scripture You see it in the oldest book of the Bible you see it in the book of Job, you know, Job was written Something like during the time of Abraham probably 600 years or so before Moses even penned the book of Genesis So the events that are related there you see there in chapter 19 verse 25 26 in that area of the book of Job That he says I know my Redeemer lives I will see him in this flesh He's already alluding to resurrection to see David the psalmist in about a thousand before Christ in in Psalm 17 Right around verse 15 alluding to the fact that he's going to experience resurrection to see it in Daniel 605 years before Christ chapter 12 verse 2, you know those who sleep in the earth will be raised up You see it alluded and yet by the time of Christ you have the Sadducees Who are saying there is no resurrection and so we have seen those who profess to be believers Professor believe the word of God we have seen them fight against the word of God What about the world the world that says there is no God and so rebellion within us is wrapped up from the earliest age We sin because by nature we are sinners Now I know that there are those who teach otherwise Mormons for example Say that we become sinners when we sin, but the Bible doesn't say that the Bible says that I am Intrinsically because of my Adamic nature in constant rebellion against God And so if God says this is the right way travel in it my flesh in my spirit My rejection plus the prompting of Satan which creates an anti God society called the world This age that we live in which is oppressively against Christ and doing everything it can to keep believers from following him Well naturally my my rebellious spirit is going to respond to that which is his most like and rather than dying to myself And saying no wait a minute God's word says this and it's not an easy path But it's the right path and said to do in that I simply flow along with the rest and then so my My rebellion and my rebellious spirit my sinful nature Begins to present itself in what it's natural for it to do That's why I'm supposed to follow scripture walk in the power of the spirit Die to my my inclinations and all and so That's one of the reasons why our society that we see that's that's a core reason of the society that we see is in Constant rejection of the things of God. So when it comes to the rebellious heart Specialized a nation. I mean, obviously, that's nothing new to God. He's he's obviously I wouldn't say used to it But but it's nothing new it doesn't shock him when a people rebel against him And there's a verse in Isaiah chapter 40 verse 15 that I want to quote It says this behold the nations are as a drop in a bucket in our and he says and are counted or I'm sorry And are counted as the small dust on the scales look he lifts up the aisles as a very little thing When you read that verse, I mean it just shows you how God sees nations. They're not he's not intimidated by this It's pretty interesting and God sees the universe that way.  He's pacing around his throne He doesn't know what to do and he's just up there saying I can just do this, you know Smash him. It's like an ant shaking. It's one of its little legs at you threatening you right, right There's another Psalm that I want to quote it Psalm 47 8. It says God reigns over the nations God is seated on his throne I think as a Christian and as we're coming into this topic God in America, I Hear a lot from Christians. They're very worried about what's going on in our nation They're worried about what's taking place, you know on the local levels to the higher levels and But when you read verses like this God is not worried. God is not nervous. I mean, he's in control, right? Well, he'd have to be if he's God, right, you know, he's sovereign and he is in control I believe that God would say that man has certain responsibilities and And and God obviously is sovereign overall, but we do have responsibilities and we ought to exercise those responsibilities as Citizens in the nation that we reside of course, but when it's all said and done I mean we read the Bible which is his revelation to us and he shows us the Consumption of history, you know, we already know how it's going to conclude so nothing is going to be changed It's written in stone. This is what is going to happen But until that moment comes we do have personal responsibility for certain things and when we look in the Bible We see a lot of different powerful nations Empires, you know, Egypt, you know, you have Babylon, Syria, you have, you know, even Rome and Where are they today? You know what I mean?  I guess if you will yeah, and yet we don't have Babylon, you know We don't have any no we don't have Babylon as it as it was in its existence We we still of course from Babel to Babylon to today. We have the spirit of Babel Absolutely the spirit of Babylon of course, but no those nations come and they go You know it at at my point in life Robert where I'm at now, you know, I've I've lived through the lifetime of some men who actually were very frightening and imposing people that At one time Caused other nations to have fear, you know all the way from people like a cruise chop, you know or a or a Mao or You name it, you know the Recently demised Hussain and others that that were Caused many people to fear many people to to actually tremble at the loss of their own lives and the tortures that they experience Etc these men are all dead Because that's what happens that they go the way of all flesh, you know, and so yeah There's there have been from ancient times to today Societies that in their day were absolutely the masters of everything around them, you know the the Alexander's and the rest who were awesome in their authority and power But as human beings they come and they go and only God remains, you know, now you're probably familiar with this This is something new to you But I just found this this statistic as we get into our topic God in America a third of Americans say the United States is a Christian nation, but more than half say the country has a special relationship with God is the United States a Christian nation I don't know that there's ever such ever been such a thing I know what that means, of course We do the underpinnings of this nation Judeo Christianity the history of this nation Dating to earlier dates even from prior to the Puritans when the Spanish came into st. Augustine Florida and and all and and many of them came Carrying the symbol of the cross and so there has been a formation here in the United States from our earliest history of Missionaries who've entered in missionaries bringing a gospel, you know I of course have a tendency to lean Towards the gospel that would have been brought by the Puritans, of course, but with that said the United States is underpinnings all of our laws and our our cultural essence is really something that was built on Christian theology and so at one point we were we were considered to be a Nation that was truly under the influence of Christian theology churches practice Early leadership many were professing Christians devout Christians of their era practicing the Christianity of their time and through their understanding of how it was to be lived out in their culture There's no doubt about that and so you look into even Supreme Court decisions where? One in particular said the United States is a Christian nation or you look at the motto I mean recently the American president Obama said something related to our American model being a pluribus unum the American motto is not a pluribus unum The American motto is in God we trust that is the official motto of the United States and sometimes we forget that we cause We say oh, no, it's out of the many one. No, it's in God. We trust it's even in our dollar bills It's in our paper money, you know, that is the motto of the United States and so it's very deeply intrinsic within the culture of Americans and even those who are not professing Christians have been affected by the Christian mentality You're standing in line You're not a believer you don't go to church You don't even think about Christ other than at Christmas and that's Christmas, right?  There are no lines There are no lines I've been in countries where there are no lines and you you get as close as you can to the person in front of you or somebody is Going to wedge themselves in there So you're standing in line this person steps in front and cuts it. What do you feel? Well, you feel upset But why do you feel upset? People don't analyze why it's because I'm supposed to do unto others as I would have them do to me Where'd that come from, you know politeness that that is very intrinsically Christian You know the way we think here We just don't see that and you don't see that until you step out of the United States And you to go you go to countries that have not been influenced to the depth that America has So there are little things here things that we will say are right and things that we say are wrong That are based on biblical doctrine You look at all the laws the laws that pertain to our society are found in biblical principles That's why when some foreign Theology Enteres in that's why Americans will say we're not bringing that in no we will never yield to Sharia law Because it is a different basis. It's a cultural different Revelation than what we have in American law That's where the cultural and religious battle really takes place, but Americans being Unaware I'd say of some of those things They they have a knee jerk. They say no, that's not right But they really don't know why and it's because we have had a blend of Christian Jewish Christian Judeo Christian Theology that has been the underpinning since the foundation of this nation So with with the whole thought of being a Christian nation and all of that I mean got in America as a topic I think it's going to draw a lot of people to tune into this podcast because it's a big topic nowadays among Christians and non-Christians too and so We may have somebody listening right now and they think they're Christians to find what is a Christian? That's been a real difficult thing hasn't it Robert. I mean because we're cultural Christians, you know You take your surveys and George Barna and others will do their their surveys and they discover that 83% will profess to be Christian you watch TV and you see commentators quite often I see it all the time or commentator will say well I'm a Christian or you see somebody there were in a cross and and that's a symbol of Christianity and all and Every house in the United States almost every house has a Bible in it because it's still the best-selling book in in our nation and all of that so One of the problems that we are finding ourselves in today is the The church I believe in general has abandoned the The gospel message in our church buildings I and I say this as somebody who's been around for a while now and an observer and and one who loves the church so The comments that some may find offensive and all you know They're not they're not I'm not being clear perhaps are not listening The way that they they perhaps should The problem is is we have become very similar. I believe to even the day of christ And even before that in the history of the nation of israel Where we are doing What amos in the book of amos and i'm studying through it so it comes to mind The book of amos says where god says you are offering sacrifices to idols And you're attempting to offer sacrifices to me simultaneously And you're mixing your idolatrous worship With that which I have required and in the mixing of the two you have polluted it So I don't recognize your your songs and I don't recognize your offerings Because they have been tainted with idolatry And I believe that what the united states is doing right now is being tainted With methodologies and messages that are not of christ Now all of my walk with the lord I got saved in 1970 so I've been walking with the lord for a while now All of my walk with the lord I have seen The insidious effort of the enemy to infiltrate In those 40 some years that i've been following christ by bringing messages that seem similar But upon close scrutiny you discovered these messages Are not really presenting christ for who he is These messages are not Are not built on scripture so much as personal experience or supposed revelation And the church has become weak because the church doesn't see that we're under attack We are under attack We are that proverbial Frog in the kettle where the water is beginning to slowly boil about us, but we're so busy Trying to find pleasure in an unpleasurable world That we're failing to know that joy goes beyond pleasure and happiness And that comes through an knowledge of the true god. So here's your problem I think one of the problems Um and that is that the pulpits of america are not thundering the word of god with righteousness That we're not really expecting the members of our church to really do what this says But we are simply feeling that well we gave that message. Hopefully they will so there's no sense From many pulpits that this this is god's word and we really need to do this because we're afraid That people won't come back that people will not give their offerings And here we are left With buildings we have to pay for and staffs that we have to support and projects that we've Committed ourselves to and thus we At one time maybe we're teaching a better more full counsel kind of message We started softening it because we're afraid of losing the sensitive hearers And and I believe what is happening right now in the united states Is the gospel that actually was presented through its fullness by just studying through a matthew mark lucara john or whatever It's not really being fully disclosed. And so The demands of discipleship, you know, pick up your cross follow me Well, I'm not quite sure whether I could preach something that harsh because today needs to be the best day you've ever experienced Or god wants you to be completely healthy every moment God wants to provide every diamond nickel that you need for everything and make you abundantly rich And what we've done is we have taken The message of job and this is what I mean by that which When job was undergoing his severe trial His friends were saying there are two things wrong with you one Is uh, you've sinned against god because in sinning against god you have lost your your health And secondly in sinning against god and and and speaking foolishly You have also lost your wealth And so even in job His comforters were saying that it's sin that is causing you to not have health and not have wealth And they were mis misinterpreting and miscommunicating god because god had a purpose and he'd already made his declaration And he said this is a righteous man the most righteous on the face of the earth So you have that little story that's being lived out right now All you need to do is is turn on a television program and you're here some guy tell you Give me 65 million dollars so I can buy a jet airplane because i'm the only voice that god is using today I've got to travel everywhere And and you have these gullible sheep right who think they're investing in the kingdom because they're not getting taught the word of god The individual who is saying that is profiting off of the people I will not call into question his sincerity But I do call into question the effect and the effect is I'm important You're not you can be important if you support this important person even though i'm not telling you the truth I'm telling you what I think is true, but i'm mishandling scripture And so getting back to your original question There are numbers of people who think themselves christian Because they haven't heard the gospel and really in faith actually said god be merciful to me I'm a sinner. I am rancid in every way shape and form. The only thing I deserve is eternal damnation But your grace has been provided to me And you've given me the opportunity to receive your message And I am a miserable Miserable person without you. I need you. Forgive me a sinner You don't hear that kind of message in every pulpit in america. You just don't You know remember there was a time when the During the revolutionary war that was stated concerning the united states that the united states is a great nation because it's a good nation And if it ever ceases being good, it will also cease being great Well, we're at that point where we're ceasing being good And those are the things that I want to talk to you here as we come to the to wrap up this this uh topic tonight But but I want to go back to what you said So basically the lack of gospel teaching Is making the lines very fuzzy when it comes to the definition of christianity or what it means to be a christian Because the word itself means christ like A christ follower and what you said is interesting because the christianity you see in our nation today Is a christianity without discipleship christianity without the cross christianity without the incarnation So when you remove those elements out of the christian faith Then you do have this carnal christianity Absolutely or this christianity where people are not really taking jesus serious and you know going back to what this nation was I mean the bible was read. I mean the bible was used in the schools And it was from 19 or 1607 to 1962 over 300 years where the bible was used that that's Unheard of today that if you walk in with the bible at a school But but one thing that I also found is according to lifeway. They conducted a survey of a thousand adults A couple years ago and their report found that belief in america as a christian is kind of fading is what they said And I was thinking about how that's happening even just recently Which it was overturned or it was obviously it didn't go through is that sp 1146 Which it was sought to take away the exemption of religious schools to anti-discrimination laws So that means that you know if a college or even a church, you know It's teaching against these things to transgender whatever You can get sued by that person. Well that bill didn't go anywhere. So that was a victory I guess for us at the moment but I think the problem that we're seeing here when it comes to the christian faith is that Christianity is almost like fading little by little as we Move forward with with the different leaders that are coming on board with this nation. Don't you think? I think that Christians by and large are Are being brainwashed by the spirit of this age to think that there's no hope. Yeah When I got saved back in 1970 and when you begin to look at the The atmosphere of the United States I mean I I I got saved in in the generation of the 60s. I got saved in 1970 but if you look at 1950 from when I was born to 1960 it was very a very idyllic time in the United States we came off of winning world war two, you know and We saw housing booms and you know many things introduced into the United States That made us very prosperous. I grew up in that time I grew up in a time when we didn't really need to take our car keys out of our cars We could leave the keys in the car at night. Nobody's going to steal it You could leave your bikes out in the front in our neighborhood that we lived in and Somebody would actually take the bike and put it in the backyard for you You know just as a neighborly thing I I grew up in a very idyllic time where you could go to the Store down the street and get the Sunday paper for a quarter And you would lift up the top paper and you drop a quarter And there'd be a pile of quarters there that others had left And you take your paper. You didn't think of stealing those quarters You just didn't do it. We lived in a different time But then we started having some very bad times we had The assassination of John F Kennedy the assassination of Martin Luther King the junior the assassination of Robert F Kennedy We saw riots in the street. We saw The imposition of the drug culture through music. We saw a turmoil Vietnam war And so when I was growing up Growing up from the 50s where it was idyllic to the 60s that were tumultuous You know, I mean I was in norwalk when the riots in watts were taking place And that was only a few miles from us and people were thinking. Oh, no, we're gonna have riots in norwalk You had new york new jersey. Detroit chicago You had killings on college campuses like kent state takeovers of Of president's offices like at berkeley.  And then time magazine is saying god is dead God is dead, you know, the christian faith in the united states no longer exists That's my time. That's when I grew up and before you know it, you've got on the cover of time, you know, the jesus revolution the jesus movement So I really believe robert that the times that we're living in are similar to the times that I grew up in And uh when people were saying there's no need for god I believe god breaks out in those times, you know, aw tozer one of my favorite thinkers pointed out that and he died in 63 aw tozer pointed out that when times have gotten dark in our history Is when god is broken out in revival He died in 63 within just a few years the jesus movement sprang into existence So even at my age at this moment where i'm at the twilight of my ministry and moving on to something else Perhaps not that long in the future robert I still believe that jesus christ has the ability to reach into somebody's heart because he's the only one Through his powerful message and through his truth Who couldn't rescue the uh the downcast the he can heal the brokenhearted He can provide comfort for the lonely He can do all of that and he can give us hope in a hopeless situation. So right now the enemy is doing all he can to to present his doctrine of hopelessness and confusion But that's when we need to stand up and be most bright and the thing that concerns me Is the church is getting lulled into this thinking. Oh, what's the point may as well grab while I can I mean that's why Some people will go out robert, you know this i'm not speaking Out of turn when I say someone will go out on a saturday night Drink party and then teach sunday school on sunday morning that happens and sometimes After church worship teams will be in local restaurants drinking their beer They just performed worship about the most high god and they're down in their suds We used to call it down in their suds they're drinking beers I'm telling you it's that it's that that is making the gospel look powerless to save That's what it is So people like you and myself and others Who are sincere? We look like we look like fanatics. We look like We're out of touch. We don't understand No, we're simply genuine christians and in the darkness the light will always be most bright It's interesting because I found this guy who said this and i'm going to quote in what we're talking here The christian faith in america is on life support because far too many of us have simply stopped living like jesus Well, I don't know that it's on life support. I don't think that the man ever supports the life right right right But I you know wanting to use his flowery language to represent the fact that the church seems to be operating on three cylinders from a ministerial perspective, I have to say That there are many tears That have been sown among the wheat and jesus made it very clear he said that that That the the church would have so many tears that people That people will see them and the tear the question i've asked is adam matthew 13 i've asked is how How do tears ever find It comfortable to be amongst the wheat. How's that work? How how can an enemy jesus said sewed these seeds? How did the enemy infiltrate the church? How does a tear feel comfortable in a place that Exalts christ and the answer is that place is not exalting christ That place became a place to accommodate sin That place became a church in name only And that's what's taking place Because in a church that actually divides properly the word of god and expects People to obey live by it be blessed by it They will shrink They will shrink because the challenge Is such that people like that rich young ruler Who find pleasure in the world and have great riches and want to have the expression of Faith you know what good thing must i do to inherit eternal life?  Very grieved because his riches were very great. And so that's america right now. It's uh, Yeah, i want to be religious. That's why we're calling ourselves as american spiritual But not christian. That's what they're saying. They're saying well. I'm spiritual I believe in a god or a higher power some other out there But i'm not willing to commit myself to to the christ. Why aren't you willing to? Well Maybe the demands of being a christian are beyond what i'm willing to yield to or Maybe the christians that i've met haven't yielded to those demands either So it's it's powerless to save You know the hypocrisy of the church today And this is no judgment on those whom i love god knows that But the hypocrisy Of the those who profess to know christ today The greedy materialism the the propping up of Of religious figures as if they're jesus himself the fawning and the the um The desire for notoriety and fame the The young man having to dress so cool and so suave and so hip and have so much glitter going on There's no true message of the gospel Coming out there's uh, there's this it seems in some of the places i could name There seems to be places that that are saying look at it's not really going to be that demanding to pick up your cross As a matter of fact, let's not even talk about picking up a cross. Let's talk about how this can be your best day today Let's talk about how sad and broken and hurt you really are without any thought of how broken grieved and And all the man of sorrows was himself to rescue us from that condition Listen, I I really believe I really do robert that that jesus christ Can take even the most horribly Broken life And heal it. I really believe that i've seen it Mine wasn't as bad as others But it was bad And I have friends That were so messed up and I thank god That pastor chuck smith and others like chuck Never watered down the message and always pointed us to the one who could heal And that's what the church needs today I want to conclude with a few questions and these questions are asked by a lot of christians when it comes to The times that we're living in today One is how should christians live? In the midst of all this chaos in the midst of this confusion and stressful times you live for christ I mean the times that we're living in again robert a moment ago I was mentioning this we think sometimes that these are the worst times that i've ever been The world has always been horrible But when you look at the time of the christians in early days of rome You know the imprisonments the beatings the the martyrdoms you know the the blood of martyrs was the seat of the church you know laws that were passed against The the message of the gospel even from religious leaders forbidding The early apostles to speak anymore in the name of this christ and stop blaming us for his death and these things We're not living in different bad times. We're living You know bad times in the sense of being the worst times ever you know I can still walk out with my bible right now and I can walk on the street and I can tell somebody about jesus christ I can't do that in saudi arabia I can't do that in bangladesh right There are a lot of places that that that if I come out even with the cross that that i'm pretty much saying kill me right now So americans are so unaware You know those oceans that surround our beautiful nation have still separated us from the actual You know british isles or the actual india whatever We only see it on tv and thus we think we know because we watched it You know we're google experts all they need to do is google whatever and I know everything without ever experiencing it But i'm telling you i've been i've traveled to many countries on the face of this planet And I can tell you that I I have there have been times when I literally Literally have wanted to kiss the ground that I was walking on when I got home Because the freedom of christ is still here the church has got to wake up to that We have to because the days are dark and the time is short But we have to wake up to those opportunities and we still have them Here's another question that I I've received in the past is has god given up on america? God doesn't give up We give up on him, but I I don't I don't know that god You know I I I don't know and forgive me this may sound Unpatriotic, but I don't know that god has a greater Burden for america than he does for france or that he has for russia or china for that matter I I don't know that god's an american I think that god is the god of the whole earth and so You know that almost begs the question was there a divine purpose? Is there a divine destiny was the united states to be really that city on the hill? Is that what god intended to do? I think those are discussions worthy of consideration But when it's all said and done I'm an american. I'm an american veteran. I love my nation, you know, I served my nation And if if I were called I would I would probably still do whatever I have to do for this nation because I love it I'm an american through and through But I also know that god loves the whole world my concerning ministry is to reach whom god has given to me And if that takes us through the united states and into the world so be it that's what it's supposed to be anyway But do I think god has given up on america? I don't think god has given up on anybody god so loved the world That he desires them to come to faith in christ. He's not willing that any should perish and so it's difficult for me to to say that america Has a special place in the heart of god But I do know we have special privileges that we ought to take advantage of amen Here's another question that I've been asked myself and I I don't I don't know I've never done any extensive research, but is america in bible prophecy I have never seen that we are which is which is Interesting because you do see nations by name mentioned, you know And there they are in scripture and they're still in existence. Maybe in a different form from when they were originally Referred to but I do not see the united states In biblical prophecy. I I personally don't there are those who are much more versed in the subject than I Who can speak about You know the british isles and their and the end their Their daughters if you will and there are those that speak concerning The fact that we are actually a colony of great britain and then you know, and you've done it And I've done it. We've seen that But what I stand up and with certainty say yes, we are that No, and and so the question obviously follows then How is it that the greatest nation on the face of the earth isn't in scripture? How is it that in consequential nations in terms of geopolitics today in consequential nations are mentioned? jordan You know egypt how are they mentioned? And here we are the most powerful nation on the face of the earth and we aren't mentioned And there are usually a couple of Answers that are given and you've given these answers. I know you have Because they're the general answers is one Is that the united states one could become so perverse twisted and lose our faith in christ that we become A nation that is no longer great in the very end and that we just become one of many nations and not the great nation That we we perceive ourselves to be Today that's a potential or two That a revival springs out that is so amazing That millions become christians the rapture occurs And and takes out the infrastructure the moral infrastructure of this nation and we're reduced To an inconsequential people and so those are a couple of the Suggested answers for that kind of question and it's interesting because I think when it comes to bible prophecy I mean the epicenter is israel and it's that that area. I mean if we're going to look at Anything we should keep our eyes in the middle east So I look at it. Absolutely. Absolutely. Yes So we're we're coming to the end here and In our nation we're we're actually up against some serious decisions new presidents And so we know the candidates without getting into all of this stuff with that But a lot of christians are kind of stuck And here's the final question that I have for you and for those listening that i'm sure we're probably asking How do christians vote? You know, we we use the term vote with your conscience And I think that that term sometimes is hijacked. It could be a code way of saying don't vote for this guy Or that woman for that matter but um I believe that we have a responsibility as i've shared in this church and you've heard me say it before That the right to vote was was fought for and died for This nation deserves citizens that value Those officials that are representing us and We need to go to the ballot box and we need to vote What most closely aligns? to Our biblical understanding So when I look at candidates I I'm not voting for a pastor. I'm not voting for a religious leader I'm voting for a political leader That represents the core values that I think are the most important to me And so I compare the candidates and I think integrity and honesty Truthfulness and things of that nature Are extremely important when it comes to um To ruling because righteousness is supposed to exalt a nation I know that in the old testament the kings were to have the conduct of the king They were supposed to live in a certain fashion and the way the king The israeli king was to lead Was through the word of god and the Theocracy that we mentioned earlier that he would use the laws of god As the foundations for all systems of justice In his kingdom I believe that there is still a moral imperative That when I vote I should vote somebody in at least cast my vote in the direction of somebody entering in To that office of presidency, which is still to this day the most powerful office on the face of the earth I should be voting for somebody who values the things that I see god values Is that person a person who is just is that a person who is honest? Is that a person who has a um a morality about them? Is that a person who? has a Faith in god, I'd prefer Somebody with a faith in god over somebody who has none But is that faith in god does it line up with what I understand scripture to teach related to what faith in god is Can I trust that person? Uh, I'm I I personally speaking of the election that is coming up here in the united states and all I have a difficult time um with with Two two candidates, you know at this moment and then if an independent should come in Um, I'm certain that uh, that'll just be a third person I have a little bit of a difficulty with But as I look at it right now um, I will be voting I will be voting for the one that represents overall uh, what I believe is Most closely aligned to The things that I value plus I will be looking at track records Uh, when I look at how somebody's life has been lived out in public It gives me a good idea of what's going to take place in the future And so as I look at the candidates right now, I'm not thrilled with either one of them But I I've already seen what happens when we try to make history By bringing in a candidate as we did with obama, you know, we're making history But that doesn't mean we made a good choice And this other candidate, you know, hillary clinton is Candidating on making history I think that That's not sufficient What I'm looking for is somebody that will answer that three o'clock phone call in the morning and actually respond to it I'm looking for somebody who is honest And forthright my problem right now and I think I'm probably speaking for others as I say this Is I have a known quality in one person and an unknown quantity in the other And that's what makes me You know more nervous is that I don't know what candidate trump will do He's just making promises. But on the other hand, I've seen what candidate clinton did And that didn't sell me at all. And so that's what's making it difficult I think for a lot of people and I'm not somebody who is going to vote for Just this candidate because I'm registered in this party but at the same time When I see the platform of a party that does not represent What I believe I can't vote for that candidate and that's kind of I think many americans are We're not voting for a pastor and we're not voting for messiah What we're voting for is somebody who lines up most closely to what I think is very valuable And that's how I vote well, it's been a very informative topic god in america pastor david It's always You know a good thing to discuss these things that are relevant and a lot of christians are always looking for answers Any final thoughts on our topic today? I think that we need to always remember that we have responsibility to do that which we have Been given the privilege to do here in the united states. We can take advantage Of the opportunities by presenting the gospel living for jesus having church service evangelizing The the lost going on the radio being in the print And all of that to get this message out I think that the church needs to wake up in these last days And we need to be aware of the fact that there's a huge battle for the soul of mankind And it hasn't ceased and none of us have been called to To go on any kind of retreat and just to give up on it. No, we're going to fight this battle And fight that good fight till we can say what paul said, you know, I have fought the good fight I'm ready. And so I really think that what we need to do as the church is to suit up and stay in the battle Amen If you'd like to learn more about david rozales, you can visit his website at calvaryccv.org If you have any questions about today's podcast, feel free to send an email to talk at calvaryccv.org Thanks for listening and have a great day


Good morning. Good afternoon. Good evening everyone wherever you are in the world My name is Vikram Rao and I'll be the moderator for the session and we'll be now starting with a wonderful session called security practices for developers and Very happy to welcome Prima Virani on stage the speaker for the session Hey, Prima. Are you all set to take over? Yes Hello, everyone. Good morning and good evening to anybody who is on my side of the world I'm in San Francisco at the moment. So it's about 10 o'clock for us that night and 10 30 in India. I think So yeah, today my session is going to be about secure coding practices particularly for developers and I'll start by introducing myself a little bit. So I'm an information security professional I've been working in this industry for the last eight years now I've worked in various industries. I started working in oil and gas and then You know have been working in tech various types of tech companies for the last five years now, so Yeah, that's a little bit about myself and I think I'll dive right into the presentation Because it's going to be a little long. We're covering, you know whole range of topics here today And I hope you enjoy it as much as, you know, I enjoy Preparing it and you know working on it. So I'll start with some of the challenges that Companies face while trying to you know, do security work most small to medium-sized companies have this you know attitude where fixing security issues sometimes comes as an afterthought and Most of us who've been in the industry for a long time know that fixing security issues after the code is live is You know a little bit of It's a difficult task. It's not easy at all and then, you know, if the attackers exploit The particular issue and if it results in a breach, then that's you know, even bigger of a problem And then you know attackers as we all know it have Virtually infinite amount of time to find bugs in the code. Whereas, you know developers who are on the Creative and defensive side of things have an infinite Time and sorry a limited amount of time and limited amount of resources that they can put towards development So the what I'm trying to say is the attackers have a significant upside In trying to win this battle against the, you know, good folks that they speak And the thing is most small to medium-sized companies don't manage to survive through public breaches They it costs them so much Especially if they are in, you know, financial space and if regulatory bodies come into the picture then A breach can be extremely expensive So, you know, the best kind of prevention of the best cure in this case is prevention and Secure coding practices is one of the preventative ways. I mean It's a very broad term and there are so many Sub categories underneath it. I'm going to talk a little bit about how exactly we can achieve it And you know some specifics So I think the biggest overarching principle to follow here is this principle called security by design And that, you know security and secure development has to be embedded into the development process itself and Not come, you know, it shouldn't come as an afterthought And security by design Can, you know, be further divided into Smaller more manageable more achievable chunks such as the, you know, less here input validation output encoding Authentication management session management communication security and you know, there are a bunch of other topics such as System security database security file management and memory management as well. They are equally as important As the ones highlighted the five highlighted on the left However, the latter the last four system security database security file management and memory management Are going to be a little bit out of the scope for this particular talk because You know those areas are more relevant to sys admins and Sres more than the developers themselves. So today I'm going to try and stick to What developers specifically and you know people who are Creating an application or an application ecosystem can do And so, you know, the four let latter four are going to be out of scope here So let me start with, you know, um talking a little more about security by design and you know, what it really means um So the role of any security team um is to Enable other teams to write more secure code. Um, in a lot of cases security teams, um are Not necessarily part of development, but they are part of review Um in the you know the entire development life cycle and sometimes what tends to happen as security gets this reputation of being the no sayers, you know, the people who are saying no often more often than not and I just want you all to know that even when the security teams do that they're You know the intention there is to try and you know be Um as thoughtful as possible of the company's overall security posture and so on At the same time us as security people we try to Always at least good security people always try to make sure that um, then you know with even if no is the answer Uh, we always try to come up with an alternative instead of just saying oh, no, you can't do that The right approach to take generally is to go and say oh, you can't do this But there are you know these three other things that you can do instead potentially Um, so think of your security team as the brakes on your car. They are intended to you know help you go faster and That's the you know job of a great security team in my opinion um, so i'll start with um some of the security by design practices and you know This is a prerequisite for all the other principles To be followed appropriately um design applications of features with security top of your mind invite your security team to collaborate um, if you can If you have the resources if the team is big enough, um, I know those can be challenges sometimes Define the security policies in the architecture itself So this is a very good way of making sure that Security doesn't come as an afterthought and it's embedded in the development process itself um threat modeling is a very useful and uh, very You know a kind of It's a very giving exercise To go through that Gives the team a lot of opportunities to try and Mentally map and model scenarios in their heads about What to anticipate in the kind of application that's being built So i'll talk a little more about threat modeling because it's a very interesting as well as a very Involving subject. Um, I won't be able to discuss Everything under the sun, of course, but I can discuss kind of some of the high levels there So how to do threat modeling is basically, you know, there are four main Things that you can try to do number one is identify and note down the most valuable assets You can't protect what you don't know. Um, it's always, um, you know, great idea to know exactly What is it that you're trying to protect and why exactly you think it might be on the threat? um, create an architecture over your overview of the Particular ecosystem that you're trying to protect. Um, and there's an optional step here where you can decompose the application um, what that means is that you decompose the architecture of your Entire, you know, underlying network your host infrastructure design Create a security profile for the application And the aim of the security profile is to uncover vulnerabilities in the design Implementation or deployment configuration of your application Again, I know that sometimes this decomposing part can be a little bit of an overkill So, you know, it's um, of course your and your security team's discretion to choose Whether or not to go that route um Then the next very important step is identifying the threats. So, uh, you know when Identifying and documenting the threats can be a real interesting thing Where if there's the approach of, you know, fear uncertainty and doubt what we call fud Everything looks like it could potentially come and harm you That's not necessarily the most practical approach because in any given scenario, uh, there'll be maybe like two or three You know most high priority things that would actually qualify as threats When it comes down to, you know Thinking about what's the likelihood of you know, that's that that threat actually exploiting my network So for example for a financial company a more likely threat would be Someone like, you know, your regular kind of hackers cyber criminals external threats versus, you know for a I mean Hacktivist or what you call, you know, environmentalists and state sponsored Hacks might not be as vigorous as your regular, you know, script kiddies and Opportunistic hackers might be so, you know those think about those things can inform the approach that you Can take in the strategies that you devise in terms of what to protect and how to protect it The last and the most important thing as I mentioned earlier is to read the threats Not every threat is going to be the top, you know, top most high priority And of course document each one of these Using a common template that defines the core set of attributes that, you know, that captures Each threat so that will give you an opportunity to evaluate And stack rank these almost against each other And last but not the least There's a lot of information available on how to do threat modeling On, you know, there's a popular very amazing useful guide published by microsoft they've also Published a tool that you can use for threat modeling and I've provided a You know, long list of resources at the end of this presentation at the end of this live deck that I'll make available later once, you know, we are Done discussing everything and you can hopefully, you know, find some of those resources useful and valuable as well So identifying the most valuable assets Is basically, you know, identifying And partnering on the following questions Does the app or feature deal with personally identifiable information or financial information or healthcare information The reason I talk about these three Before, you know, anything else is because These three are scrutinized. They are regulated by policy by law of most of the countries In the world that, you know, attack businesses are currently established and or are running in So it's very important to protect these three at the very least Of course, there's your after you're done, you know, thinking about these three. There's your employee data to protect There's your customer data to protect and so on But if, you know, you're dealing with any of these three you should especially be careful Um What are the most valuable assets? So, you know, uh, clearly record and track Things like subsystems trust boundaries. Uh, trust boundaries can mean, um, you know, something as simple as, um Basically, where does the data come into? Um, uh, where does the data come from? Where does the data go to and within your application? What kind of processing happens what should come in and what should go out and what should absolutely not Leave your, uh, specific ecosystem that you're trying to develop or protect It's very important and very, um, useful to think about those things. Um, then, you know, think about how is the data protected Violets and transit, um, are your networks encrypted? Uh, can you know, um, anybody On your network practically sniff, um, all of the sensitive data. If that's the case, then, you know, You might need to think about a strategy there to, um, implement and to an encryption between those two sources, um, in between which data is flowing and then, um, design is something that, you know, You need to think about network and host infrastructure how it all Talks to each other and so on. So at the top most important things to think about are data and transit and data at rest And how it's how exactly it's protected. It's very important for a team to know that, uh, especially when dealing with sensitive data Identify and document threats again. Um, and you know, internal threats are equally as important as external threats and I want to highlight that because, um, you know Often when carrying out this exercise, um, in of course, you know, we again within the company itself We don't want to create this environment of kind of fear uncertainty and doubt as well. But at the same time, um, we must always kind of, um, leave that room for doubt of, you know, so of an occurrence like that, um And so on and internal threat plus external attacker is generally the most widely used, uh, strategy, um, in a lot of the successful massive public breaches. So there is this, um, You know, very public breach that happened a couple of years ago. Oh, actually four years ago now. Um, It the victim here was a company called shapeshift.io. It's a popular crypto company and, um, the their story is fascinating and, um, you know, this is one of the quotes from that article that, um, in this case, the Hacker, the external third party hacker was so surprised and appalled by the internal person who was trying to help him basically hack into the company successfully that in one of the correspondences with the company employees, um, the hacker said that even the You know, I said cease communication. Can you still send me an email when bob gets sued because that bob person was the internal person who, uh, helped this hacker Get into this company's network successfully and this was the hacker saying that I feel really shitty That I feel it's really shitty to steal from your own employer.  It's a very fascinating read. Um, and it's full of drama Uh, but yeah, always be mindful. Uh, and you know, make sure that you capture the inter possibility of an internal threat at all times because No matter how trustworthy everybody is you just never know and As I mentioned earlier rate the threats not every threat warrants an action Um, so prioritizing is a very important task to do here. Um, generally the priorities are determined by, um, Likelihood and impact of a particular threat. How likely it is that something like this can happen And if it does happen, what's the blast radius? How much damage can they make and this damage can be, uh, You know in form of the you can assign a dollar amount to it. Um, if it's, um, you know, if the organization is Of course that mature and the, um, assets that you're trying to protect are so well defined. Um, That's one of the best ways of identifying impact. Um, of, you know, A potential threat manifesting itself into a breach at any given point and of course, you know, work on the most significant first The highest priority should be addressed first, uh, followed by the Next priorities and so on So, yeah Security by design. Let's talk about input validation. These are, you know, these five, um, main line items are some of the Most important key areas to think about while trying to implementing these security controls in the Design cells and in the architecture itself while trying to develop an app or application ecosystem so input validation is, um, you know, the Basically craft the art and the craft of making sure that your data When whenever you whenever your application is taking in input from Your consumer, it's always properly formatted. Um, it helps make sure that SQL injections LDAP injections and So on don't happen. So what an attacker can do is basically they can, um, you know And enter garbage Like looking text, um, followed by some, you know, special characters and so on in order to Basically gain access to your back end Using just the front end. They don't even need to hack into any of your the database the Host that hosts your database or anything like that. They can literally the front door The front end can be the front door through which they entered into your back end So, uh, making sure that for input validation, it's important to make sure that, you know, there's syntactic validation as well as there's semantic validation and, um, you know, The structured fields. So for example, social security number or tax file number These should be, you know, digits only. Um, this should be limited to 12 characters. For example, um, and date time should always be, you know, The two letters for two numbers for the day two letters, two numbers for the month and two And four numbers for the year and so on and restricting this make sure that, you know, The attackers aren't able to enter special characters in the form fields that they're trying to Exploit and also make sure that there's, you know, you check for the correctness of their values So the start date should always be before end date and never after And the price should be with an expected range and so on because the attackers can manipulate that to get an error Which can be, you know, which can reveal a whole lot of interest in sensitive information and that error dump can be then used to, um, Exploit something further. So You know, just be aware and mindful of it and this is an example of an sql injection attack where, um The attacker is able to Basically in the password field, they are able to enter the password or, you know one equals one and then, um Enter the script that they want to enter in order to get the data the dump of their entire database and so on and, um In a lot of cases, this is not only good security practice. It also optimizes your code for performance. So, you know, this is Input validation is it saves you both, you know, in some cases computing cost and also helps you stay secure Use native data tape validators that are available in various web application frameworks. Um, those are, you know, optimized for performance and for security generally and remember the JavaScript needs both client and server side validation because If you're doing only client signed validation, then, you know, an attacker can bypass it using a web proxy and, um, Or a web browser where that disables that Using which they can disable JavaScript and so on, uh, refer to ovasp is a very very useful resource, um, to, you know, refer to For great security practices, they have a ton of cheat sheets, uh, that they publish that you can follow It's literally a checklist of things that you can do, you know And I have provided everybody with a link, uh, for those at the end as well So let's talk about output and coding quickly. Uh, this is the, you know, process of converting Untrusted input into a safe and formatted input.  That's and that's being entered So, uh, this also, you know, helps make sure that the display input to the user without executing it as code in the browser and, uh, without putting coding, um The developers can make sure that they always translate special characters. So that again helps, uh, Prevent those SQL injection possibilities and so on and this is a very good mitigation against, uh, cross site scripting vulnerability as well Um, let's talk quickly about authentication management. This is one of my personal favorite topics to talk about as well because it's very thorough It can seem complex, but it's uh, kind of some of it is very common sense Um, so yeah, um, let's talk about authentication management The this is actually the most, you know, popular and obvious of all controls as well. Um, it's all about verifying identity Making sure the app always knows who it is that who's trying to get into the ecosystem What kind of access that they're trying to, um, you know, what kind of access do they have to the resources that they're trying to access and, um, of course do not allow logins with sensitive accounts. So for example, uh, Admin logging in with admin should if possible should be, you know, prohibited and so on and even if it is allowed, um, The interface that and the options the functionalities one gets when logged in as an admin Should ideally be different to the functionality that one gets when logged in as a regular user This helps make sure that even if somebody is able to exploit, um, the admin, you know, login credentials, for example um, they are not able to Do too much damage. So this helps narrow down the blast radius and then implement proper password strength controls as well. Um, there should ideally be different authentications Solutions for internal access versus public access. So, you know, with internal employees It is usually possible to implement Keybase authentication and so on. Um, and that ideally, you know, uh, should be done It helps make sure, uh, it helps the company make sure that, um, the employees are always so And because in order to authenticate, um, one would always to authenticate This is an internal employee one would always need these, uh, set of, you know, private keys and so on Which are slightly More difficult for attackers to compromise as opposed to passwords And remember encoding is not encrypting if you can revert it. It's encoded if it's if you can't revert it It's encrypted.  So, uh, your error message should never show Exactly what went wrong. It should be just generic enough for the, um, consumer to know that something has gone wrong This kind of this is a little bit of an security by obscurity technique, but it really works and, um, enable multi factor authentication You know, I know in india at the moment, it's particularly popular almost every app that you're trying to use Has, you know, this thing where they send you an otp Before successfully longing you and and that is the, you know, very good security measure But at the same time with, you know, uh, all these attacks on the telephone providers and carriers themselves Um, it can be really easy to transport, you know, the The sim transport attacks, uh, can be really easy to carry out. So, um, solution to that is to make sure that, um, The users can use, uh, authentication application as well. So something like do or google authenticator Um, and, you know, providing the consumer with the choice of using either otp Sent through text message or through generator through this authenticator application. Uh, can be really useful And, um, make your application, you know, password manager friendly people should be able to You know copy and pay basically paste passwords into various form fields and so on, uh, your, um People using, you know, password wall should be able to quickly fill out the form from within the world itself You can enable all these functionalities to encourage users both internal and external to use the password management tool Which helps them create really long, uh, secure complex passwords. Um, again, account lockouts and captures also increases friction for Attackers, uh, and you know, helps, uh, hope hopefully helps keep them at bay From exploiting the application successfully. Um, let's talk a little bit about session management here. So Session management is basically, um, you know Once the consumer or any user is established a session with your application by, you know, authentication Authenticating successfully and so on. Um, the app at all times should be aware of Who that user is and how, um, you know, they can prove that they are who they claim to be So, uh, the session ID session IDs are, you know, popular way of conducting session management and Session ID names used by the most common application development frameworks Um, uh, tend to be, you know, it discloses the Technologies the names of the technologies and programming languages used by the application. So, um, uh, if possible, you can You know, change that, um, and make it more generic so that it doesn't kind of Give out all this information and then, uh, minimum length session IDs, uh, prevent, you know, uh brute force attacks and so on. Uh, session timeouts are really important. Um, implement idle timeouts Absolute timeouts and, you know, renewal timeouts. So idle timeouts are basically it limits the chances of an attacker Um, for guessing, um, and using, you know, valid session ID from another actual user who successfully logged in at the moment Um, absolute timeouts limit the amount of time an attacker can Use a hijack session for in case they are able to hijack a session. Uh, so this is a, you know, what you'd call an onion model This is a layered approach where you prevent one measure But you also allow for that measure to fail and have like a what you'd call a backup measure in case measure number one fails Um, and that is generally a pretty good security strategy overall So, yeah, um, session management again, uh, mitigates again session riding and cost site request forgery attacks. Um, Help, you know, manages session IDs appropriately and then, uh, change session ID names as I mentioned earlier From default to generic, um, minimum length of session ID should be 128 bits, um, or 16 bytes at least and the entropy should be 64 bits at the very least um Use pseudo random number generator as well Um, and then, you know, for sessions, uh, make it strict never accept user generated session IDs Treated like any other input basically validated and implement timeouts as I mentioned earlier So that's kind of, you know, summary of, um, everything that we've covered earlier and um, a simultaneous session law burns um Use built in, you know, session management frameworks use web application firewalls simultaneous session log on should be, uh, kind of, you know, limited as well in nature Um sessions are usually managed through cookies cookie management is a topic of its own and, um, you know That again is out of the scope for this particular talk But I really recommend you go online and, you know, read about it or ask again It's a very good resource to look up this information log all the authentication and session activities This really helps, uh, if an attacker is successful if an attacker successful, um, it really helps If you have logs available and ready to surf through of all the activities that went on In order to trace, um, your steps back to when, you know The attack might have started what might have happened to recreate that entire story that unfolded essentially logging, um, all your sessions is if you can't go wrong with it as, um, pretty much And communication security that's kind of, you know, the last of the methods that I'm going to discuss today here, um, implement TLS for all communications So this is basically making sure that your data is always protected by let's and transit from point A to point B And, uh, implementing TLS is a very good way and a very popular way of doing that There's a website called let's encrypt it. It's basically an open certificate authority and it lets you obtain a TLS certificate for free So this is basically if you want to make sure if your website is always on HTTPS Let's encrypt let's you do it for free. Of course, there'll be, you know, um, manpower and, you know, uh, Sysadvent's time that potentially goes into it and into implementing it, but the actual resource itself is free and disabled TLS compression reconsider, um, You know the use of wildcard certificates um Try and limit it as much as possible wildcards are, you know convenient, uh, but you know the likelihood that the private key or the certificate is gets compromised increases and As the key may be present on, you know, multiple systems. Additionally, the value of the key is Significantly increased because suddenly it's giving you access to, you know, 10 resources instead of giving you access to maybe two resources So makes it it makes it more lucrative and an attractive target for the attackers And the attackers generally can see if you're using the wildcard certificate If you know your chrome web browser has that little padlock on the left corner Through that they can actually see the entire certificate chain and who your certificate authority is and how they you know, um Basically should your certificate they can see that all those details. So be mindful of that and You know, you see a records Restrict, which uh, so c a record is a certificate authority authorization dns record um It can be used to define which certificate authorities are permitted to issue certificates for domain So what this makes sure is that a chinese company or like a attacker is not able to issue a certificate under your name from a dodgy third party chinese certificate issuing authority for example um and That you know first helps you stay protected it narrows down who can issue certificates for your company for your domain and A page that's available over tls should not include any resources such as you know JavaScript or css files which are loaded over unencrypted at issue degree because then it kind of you know Defeats the whole point of you're using the same resources Both in you know, while encrypted communications are there and unencrypted and These unencrypted resources could allow an attacker to sniff sessions a session cookies Or inject malicious code into the page even on your HTTPS pages so be mindful of that And again, you know These are some of the kind of general other general good practices system security Be mindful of these things database security patch Patch all your systems all your databases follow the principle of least privilege the employees also should Only be able to access the minimum amount of information that they'll need access to it any given point of time to be productive And make sure you do file management appropriately protect the local file system from unauthorized access And perform memory management. So these four Topics were the ones that you know, I couldn't cover today because they were out of scope today but These are definitely for you know, very important things to be mindful of and discuss with your sys admins or sids so with that I will open it up to questions and Again, I hope you found the session, you know useful All the resources are available at the end of the slide deck, which I will Make public at the end of this conversation. So thank you so much Hey prima, thanks for the session. It was wonderful. Um, You know, I've been in this space as a developer for a long time. So I had a question I'll invite the audience to you know through their questions too So you said about wildcard certificates or not, uh, you know think about it, right? So what is what could be the wrong problem with wildcard certificates, right? So, uh, the one of the biggest problems with wildcard certificates can be that, um, it so They are generally used on multiple resources, right? And uh, that makes that means that if the certificate is That one certificate is compromised. It's compromised in n numbers of your system that you're using the wildcard sets on and also, you know through, um, the Any kind of what you call it a season smart attacker will always examine your website's Certificate chain who is the issuer because they can always try and compromise the issuer directly as well And that actually has happened in the past. It doesn't happen so often anymore But, um, it does happen. So, um, they will examine whether or not you are using wildcard sets And if they see you do that even publicly then, you know, they will probably it'll be more of a motivation For them to try and compromise it because no because they know that, um, there are multiple Potential resources that they could get access to potential sensitive resources versus, you know, just one and That is a good enough motivation for somebody to go after it and chase it and Not using wildcard sets, of course Make sure your blast radius is narrow and that you're not giving out that motivation to the attacker to come after you Okay, so we have a question from harpal sing, uh, if you want to check that or you want me to read it Yes, I am actually reading it right now. So I think harpal is saying What basic competence is needed for a developer to understand the need of embedding security in day-to-day work? Is this specified anywhere? Yes, it is and I'm so so grateful and glad that you, you know, ask this question So, oh wasp is something that I mentioned through my kind of presentation quite a bit as well Oh wasp is an organization that specifically Creates resources for Developers people who are not full-time security professionals They create resources for developers to use that, um, you know, they can potentially kind of leverage while you know while in the process of Creating their own applications and can be mindful of and they give it to me in a very palatable like checklist format So you're not, you know reading through a wall of text at any given point of time It's just a one or maybe like two three pages Of you know checklist to go through and you can just quickly glance through it and Make sure oh, yeah done this done this done this done that And wherever confused they also provide you with you know detail kind of information and examples of What a particular attack entails and What it would look like and what you can do to mitigate it. So go check it out I've included the link to these resources at the end of my slide deck There's actually a resource section I can quickly show you that as well. So this is microsoft microsoft guide to start modeling There's a jango validator apache validator. Oh wasp cheat sheets Then you know all the different very specific cheat sheets as well So please go check it out. Um, I hope you find it useful Can you explain? Um, I'm reading bird of verma's question Can you explain more on accessing accounts admin should avoid logging in with admin account? No, that's uh, not what I meant at all when I said that so there are kind of multiple you know things that um We can make sure that uh to make sure multiple things that we can do to make sure that uh Your admin accounts function. So the one of the most important things To do is to make sure that your admin accounts are, you know, there are no generic just admin account so every admin account even should Be traceable to an individual at every given point of time We should be able to trace an individual's identity with every admin, you know login attempt That could be a part of uh, how you design the admin account. So for example, um, you know Each admin account should be associated with an actual user with a unique username and password That's one way of doing it another way of doing it. If you know, this is not possible Another way of doing it is to make sure that the Log on, you know attempts are recorded and it's recorded Where you know each Uh admin session is coming in from from which ip and so on and you should be able to go downstream and associate that particular ip's identity with a user confidently and You know successfully. So that's one thing another thing is that every um, so admin account doesn't always Need the same level of functionality As a regular user account. So for example as an admin, I might only need to make sure Who different users are and whether or not their accounts are enabled or disabled and I probably need the functionality to enable a disabled account For example, whereas a regular user account. Um, that's not an admin account. They might have the Uh capability of carrying out the you know actual what happens to a particular consumer's data and so on so if you if you can to separate those two functionalities out And make sure that you know admins are able to access the bare minimum they need and then the non admins are able to access the bare minimum that they need That's usually a good practice. Again. I understand it can be a little complex to implement and so on But that's the this is the generic idea that I'm describing. So I hope that answers your question um Do we have time for a couple of more questions or maybe one more question and Then people can go for a break Yeah, uh, we can take uh, maybe another five minutes. So whatever we can cover in that time for sure, um Is there any tool developers? Um, I'm reading atreish Uh, krishna pa's question. Is there any tool developers can use and ensure all of us checklist items are addressed and uh piece of code he has written is compliant with security requirements um I I don't remember them on top of my head at the moment But i'm sure they exist. But I also know that um, even the ones that exist are not very mature yet So, you know, the rate of false positives in terms of what a little flag that you know, you haven't implemented That tends to be really high. So at the moment, unfortunately, the best way of doing it is to do it manually Um, but that sounds like a great area of opportunity for, you know, the next kind of wave of starter founders I'd say and try and make that more efficient more automated um, but you know, it's also harder to implement because um, each of these functionalities are implemented differently in each different frameworks So the way jam you implemented in jango might be very different to how you implemented in node.js And to you know, create a solution for every single one of these stacks Can take a while. So yeah, that's kind of the scoop on that um Okay, um Could you touch upon very few basic security practices that DevOps engineers should practice Where they are involved in continuous deployment? Yes, I can talk about a few things. Um in context of AWS particularly because you know, that tends to be the platform that's um, the most kind of popularly used by a lot of DevOps engineers and uh, one of the ways of making sure that you know One of the most kind of basic ways of making sure that security practices are adhered to is to make sure that you You know, none of the changes that are being made on the platform itself can be made directly through the console And they should all be probably pushed As code through, you know, third party to like terraform or something equivalent of it And whenever these changes are pushed, um, you know A security should probably be one of the mandatory peer reviewers.  What security threats we should be mindful of so ftp inherently is insecure It's not encrypted and it can be slept very easily Try and use sftp wherever possible for large file transfers another somewhat of a hacky, but slightly more secure way of doing it is Use apps like dropbox google drive and so on they are literally made for this purpose And there is an entire team working on securing these transactions and these connections so so that you don't have to worry about that implementation yourself and It's kind of done, you know out of the box for you It's you know, they are very easy to use tools and everybody it's very intuitive as well So try and you know advocate for those where possible because you know to build everything that every time is A not possible and B not feasible It might cost you knowing the time that you're spending and trying to implement those versus the benefit you are getting out of those So always consider that kind of cost benefit Okay, um, thanks prima. I think we kind of have run out of time. Um So it was a wonderful session and uh, thanks a lot. Thank you so much