Welcome, welcome, welcome. Welcome to Cloud Native Live, where we dive into the code behind Cloud Native. I'm so excited for today's session. I'm your host. My name is Whitney Lee. I'm a CNTF ambassador, and I'm a developer advocate at Tanzu. So here at Cloud Native Live, every week we bring new presenters to showcase how to work with Cloud Native technologies. We'll build things, we'll break things, and we'll answer your questions. Today, as you see, we have Baruna Charya here with us to talk about securing the secrets manager with cube armor. So this is an official live stream of the CNTF, and as such, it's subject to the CNTF code of conduct. So all that means is please be nice. Be nice to the other folks in chat. Be nice to Baruna. Be nice to me, please. You don't have to be that nice to me. Just everyone else is important. Friends who are joining us live, will you please put your name in the chat and where you're joining us from. I love seeing that this is a global community. I think it's the coolest thing. And I think that's all. Oh, here's what I want to say. There's questions. If you have questions during the presentation, please do ask those questions in chat. We're going to make this more of a conversation. Baruna's going to share his screen the whole time and code the whole time. No slides. So we're going to have a nice, a great conversation, and we can't wait for you to be a part of it. So with that, I'm going to hand it over to Baruna. Baruna, introduce yourself, please. Hey, folks, I'm Baruna Charya. I am a fellow CNCF ambassador as well. And I am a maintainer and leading the development efforts of Cube Armor, a CNCF Sandbox project, which we will be discussing, diving very deep into today. So look forward to that. I work as a software engineer at AcuNox. AcuNox is a cloud security solutions company where Cube Armor as a project originated. So that's all. Awesome. That's amazing. I'm so psyched to have you here. You and I have streamed together before, so this is like a chat with old friends. Are you ready for me to share your screen? Yeah, give me a second. All right. Yeah, I'm ready. All right. Here we go. So I think it's lovely. While you're didn't do that, I'm going to say quick hello to all the folks in the chat. We have friends here from Palestine. We have Dallas, Texas. We have Vancouver, Amsterdam. How cool is this? We have Germany and I don't know where Sherry Povitz is, but hello. Greetings. Thanks for being here. Awesome. So, hey folks from all over the world. So I'll start with introducing Cube Armor to you. So Cube Armor is a cloud native runtime security enforcement system that helps you restrict behaviors such as processes, execution, file accesses, networking operation. And this happens inside containers or your virtual machines themselves. It could be either on Kubernetes or your bare material virtual machines at will. So Cube Armor is not tightly coupled with Kubernetes, but it can help you enforce things on containers running on directly on your virtual machines or virtual machines themselves. But you might ask what kind of enforcement are we talking about? So for that, what I'll do is we will dive directly into the Getting Started Guide here. Before we actually try to secure the secrets manager, I just wanted to have a brief introduction that what exactly is enforcement and how does Cube Armor go about that. Because runtime is something very new in the ecosystem and it's crucial that we understand what's that before we actually try to use like protect our secrets manager at runtime. Excellent. Will you zoom in a little bit on the webpage please? Yep. Thank you. Excellent. So this is the Cube Armor Getting Started Guide. And as any other tool you can use Helm to install Cube Armor. And it's already shows that okay, Cube Armor already exists. It's going to fetch all the repositories and do the installation as needed. And we can see that Cube Armor is, yep, Cube Armor is running in our Cube Armor namespace. And if I run Q Armor Pro. So Cube Armor in general, we are using Helm to install it, but we have an helper utility called KR Merch CLI, which helps you dive like get into like it's a user friendly way to interact with Cube Armor. In general, Cube Armor has many like it is Kubernetes native. So you can use CRDs. You can integrate it with Loki, Grafana, Elastic, any stack you have to interact and retrieve information from it. But for today's session, we are going to restrict ourselves to KR Merch CLI, such that which is one of the easier ways to interact with Cube Armor. So we see that, okay, Cube Armor is armoring up our clusters. And my cluster is a three node cluster on Google Cloud Engine, which has container security set to true. And all of these metadata, which we are going to dive into today. Awesome. So here we have a sample engine X application and I record and deploy it. Engine X already exists. So when did all that metadata get set? Did you do that? Did that happen upon installation? Yep, these are the default configuration of Cube Armor. So these information are node level information that, okay, Kubernetes has these nodes and this is the configuration that Cube Armor sees that. Okay, I'm running on a Cubelet version of 1.2.27 and the LSM that Cube Armor is using is, what's LSM? We are going, we will dive deeper into it as well. But that's the secret source that Cube Armor uses spoiler alert. So that's the secret source that Cube Armor uses to help you protect your containers and host. And all these are default configuration of Cube Armor, which we are able to tweak around, which we will be tweaking around today as well. So since engine X is already there, we are going to apply a sample Cube Armor policy. This is a sample Cube Armor policy. It's a Kubernetes resource called Cube Armor policy. You have a name, the name space is default because engine X is deployed in default. And we have a match labels here that, okay, let's set, let's enforce this policy on any application that has the label engine X. And at the end, we are going to call it block the execution of user bin app and app. This is a very interesting policy because you know how package management, you should not be executing any package managers in your containers, right?  So you know that if someone is executing a package manager in your container at runtime, something malicious is happening. And you should be very effective. But we will have a policy here, which will help us with protecting that malicious activity from happening itself. So while that policy applies, and the policy is there, I'll do is I'll try to execute app deploy slash engine X. Oh, that's being hidden when it's on the bottom of the screen. It's behind your name. Can you, I can remove your name. Basically, I can't see your commands when you're typing on the bottom line of your terminal. Okay, cool. Yeah. So we have, we are executing in the, to the engine X container and running app update and app install mass scan, mass scan is used to do port scanning and all that. And it's generally something that malicious actors do use for to look for open ports to perform their further attack operations. And you see we got a permission to write the process itself did not happen. And you might ask, how do I come to know about that? This was done in my cluster or not. So we have log logs for that. So KMR sends out telemetry information that something like this happened. And I will boil it again for you. I'm on the edge of my seat. I'm so excited. Yeah. So the, we have the alert here. Kuberma says that, okay, something happened in the host. This board name was engine X. There was a container. You have all these metadata that helps you identify where, which was the container where it was, it happened. And finally, it was that, okay, after night, to certain reasons, you may or may not need this information, but Kuberma has that entire context so that any like security operator realizes that, okay, this has happened. And I can take further actions to do that. Okay, probably this container is compromised. And I need to take further actions. But the action itself was denied then and there. So I have a piece of mind that, okay, nothing unsafe has happened yet. But I might need to be cautious about, okay, let's see what's wrong. So that's what Kuberma is for you. And I mentioned that Kuberma uses LSMs under the hood to achieve this. So we have this enforcer mentioned here as BPF LSM. So LSMs are Linux security models. They have been in Linux kernel for more than two decades now. So they are a trusted way to enforce policies on your Linux machine. But so you might ask, why do I need Kuberma then? So Kuberma comes into the picture because these LSMs were designed for Linux kernel back then. And the landscape has changed today a lot. We have Kubernetes ports, multiple machines running as part of a single cluster, thousands or maybe tens of thousands containers running inside our clusters. So it's difficult to manage those entities out there. And the LSMs in general, whatever mechanism they have, they won't have the information that, they would have these information that, okay, some PID 49696 was denied. But what is 49696 for me? It's just a number for me, right? I need that entire context that where it actually happened. And that's where Kuberma comes into the picture that I have this alert with the entire context. Another question that people ask is, do I need K-Armor utility to get these telemetry? And that the answer is not, that's false. K-Armor is just a utility so that you quickly gain this information. But you can integrate any of your SIEM tools. And we mentioned it in our docs as well that we have a guide entirely for the same that it's a generic way that it's in some ports STT out. So you can integrate with your Fluentee or Logstash to fetch those logs and push it to Elasticsearch and have that entire ELK, EFK, whatever stack you follow, you can integrate it with that or Kuberma exposes it on a GRPC endpoint. You can manually write your adapter to integrate it with, integrate the logs as well as we support OpenTelemetry, which is a standardized way of exporting logs and traces. So if you are operating on top of OpenTelemetry, any OpenTelemetry related tools can integrate with Kuberma. So that's... We have a question from chat. Can you discuss the overlaps between the commercial offering of Sistig to Kuberma? So Sistig is a commercial version of Falco. Yes. That's it. So Falco and Kuberma are like, they target different things all together. And Falco and Kuberma both are runtime-secured engines. But where Falco shines is that Falco is a threat detection, a runtime threat detection. It only monitors for what's happening and it helps you with identifying that something malicious happened and you want to take actions on it. There are automated ways to take action on it as well. Like you can go ahead and kill the container and all the liberated actions can happen. But that's still post-attack mitigation. So we talk about that in our Getting Started Guide as well, that differentiation. So essentially, if what happens is, okay, this is a pond pod that someone did attack your pod and there was a malicious execution. There was an EBPF event from Falco. There's an event handler and then the event handler goes and takes action on it. But how Kuberma does this is that it denies then and there that, okay, this execution itself at level one would have been denied. And you would receive all the telemetry information relevant. So that's the power of inline mitigation that any further containing nothing like the attack itself is contained then and there itself and all the other actions. But where Falco shines is that it has a rich ecosystem of integrations and it helps you with all the threat detection mechanisms. So that's the differentiation overall. I am not sure about what other offering that SISD conversion parts include. But that's how Kuberma is differentiated in general that we go for inline mitigation and help you contain the attacks that way. So inline mitigation is the terminology for when an attack is stopped as it's before it happens. Is that what I'm understanding? Yes, yes. So as it happens, it is denied. So that's an introduction to Kuberma. We have, we already saw that what's the capabilities of Kuberma. But what I'm now going to do is let's get on with the topic that we are here for. We are going to secure the secrets manager itself so that you keep your secrets safe and secure inside secrets manager.  And that's where we are going to talk about the problem statements and how we are going to prevent that. For today's discussion, we are going to use hashikov vault. Hashikov vault is a secrets manager, very well known secrets manager, and we are going to go and secure it. So let's install hashikov vault. I think I already installed it. Check it using help. There might be audio. I think we're just quiet. We have someone in chat pointing out that there's no audio, which I appreciate. I would like to know that. But I think we're just quiet and watching Baroon work right now. Baroon is installing hashikov vault and then going to show us how we can use Kuberma to secure the vault. You do hear me, right? Just check. I can hear you. Nice. Okay. We deployed hashikov vault here and let's see if we can access it. Okay. It's still container creating. Let's wait for it to start. While we do that, let me talk about why protect secrets manager.  Why do you need it? Even if some attacker comes into my container and tries to access the secrets, what would they get? It's already secure and encrypted and all that. So I don't have any losses, right? Even if they do able to access it. But now the issue is what if they go ahead and delete your secrets? What if they go ahead and add an encryption layer on top of that? Now you yourself are logged out from accessing your own secrets. And now that's how basically ransomware attacks work that now you need to pay for ransom, pay the ransom to get back that access. So where Cube Armor will come into the picture is that it will not let, even if an attacker sneaks into your secrets manager container, it will not let them delete, add an encryption layer. So all that, it's all completely safe and secure. And I hope the world is running now. It is running. So let's try accessing it. So to do that, Vault's looking at the system calls at the kernel level of the machine that the HashiCorp Vault is running on. Is that correct? Can you repeat it? To do this, to protect the data in the Vault, what it's doing is looking at the system calls on the machine that the Vault is running on. Is that correct? Yeah, that's right. So that's a nice question that how, where is Cube Armor running? Is it just a part or is it, how does it know that where, on which node Vault is running and how is it protecting it? So essentially, if you look at the Cube Armor manifest, you see three Cube Armors here. Essentially, this is the main engine that protects your containers. And there's an operator so Cube Armor uses operator-based installation. And there's a relay server, which helps you with all the SIEM integrations that we talked about. But the reason you are seeing three Cube Armors here is that Cube Armor installs itself as a daemon set. It's monitoring all the processes on all the actual nodes. So daemon, it is running as a daemon in all the nodes itself. And that's how it knows that, and it has all the metadata to actually go ahead and then construct the telemetry that it needs. I have a question around that part of it. Looking at all of the system calls on all of your machines seems like it might take a lot of compute. How does Cube Armor, is Cube Armor like a heavy technology? If you see right now, Cube C, it's 17 mCPU and 100 mM memory. So it's using not much. It's very decent amount of usage for the kind of things that Cube Armor is doing. And because how does it do that is... Yeah, but you're also not making a lot of system calls right now, right? Yeah, if you show you... Involved itself has started already, right? There are things running. If I show you the cluster itself... Okay. Okay. A, you will see there are a lot of things. I hope I don't seem... No, no, no. That's completely valid. Okay, cool. So if you see, this is traveling, like a lot of system calls are already happening. And why is it efficient like that? Because Cube Armor uses EVPF and all that, right? So everything is happening inside the kernel itself. And because we are intercepting the information right at the kernel level, nothing... So the overhead is pretty less from what we benchmarked with... Like it's an opinionated benchmark, but the overhead that Cube Armor adds is less than 3%. And we have published that data as part of Vicky. And that's decent considering what... How Cube Armor is helping you enforce things here. And monitoring all this is called... Like as you said, a lot of system calls are happening right now itself. All the network calls are being changed. But you might ask that... We will dive deep into... Even this is a lot of information, right? And you can choose to configure Cube Armor in a way that, okay, I don't need network information altogether. Let's disable it together. Disable it altogether. So all that configuration options are all there. So it doesn't have to monitor every single system calls. You could say, I only want it to monitor when a file is opened or something like that. And then it'll do that. Yeah, okay. Interesting. We have another question from chat. I just totally railed your... You're trying to talk about Vault and we're getting into other things. But the question is, what level of kernel exposure slash coding is required to make the most out of EVPF offering part? So Cube Armor itself, as you saw, right?  But whatever you see here is all structured data. And you don't... You need to... Is the EVPF experience to get these data altogether? So it's purely how you manage any Kubernetes resource, you are going to manage Cube Armor as well. It's all YAMLs, annotations, labels, that's all the concepts you need. You don't need to write actually EVPF code to do anything. That's the complexity that Cube Armor handles itself. You don't need to worry about that. And that's why you need... You don't need to understand EVPF at all. There are some parts like you might need to understand... If you make a lot out of it, you might need to understand what's process IDs and how to go around. Actual protection will be handled by Cube Armor, but do the day to operations that, okay, this attack has already happened. What are the next steps to debug? Where in my entire infrastructure actually caused this attack to sneak in? That's where you might require further to understand some level of process ID, what's process ID and all that information to go ahead and debug that. We have a nice statement from Jay that he appreciates our conversation and digging in about... There probably aren't many system calls happening. And then we also have a question from Kuldeep. So we're talking about securing HashiCorp bolts right now, but does it make sense to use Cube Armor when we're using a CSI driver to mount secrets? So you could still use Cube Armor to secure Azure Key Vault or to secure AWS secrets manager, those two technologies themselves, right? Because Cube Armor is not very specific. But I'm not sure how AWS secrets manager will be posted in their own private clusters, right? So if AWS chooses to do that, I'm not sure if there's a self-host option on these two management solutions. But what you asked is that, like what Kuldeep wants to know is the CSI drivers goes ahead and mounts those secrets inside certain ports so that they can leverage those secrets. So you can go ahead, you can definitely use Cube Armor to secure those volume mounts themselves. So the secrets that are mounted inside, so that only certain binaries inside a particular like pod are able to access those secrets. You cannot go ahead and cat that secret or RM that secret. So that's there, yeah. So it totally makes sense. And that's a valid use case. We are actually going to secure volume mounts in Vault as well. But for some reason, Vault is not letting me initiate it. So I'm checking that out. Some live debugging is going to happen there. We promised up top that we'll break things. So we're delivering on that promise. Kuldeep has a comment. I just want to say you're talking about Sistig and Falco. So Kuldeep, you said you joined late. We already talked about that already. So I recommend you catch that as part of the recording. But the short answer is that Cube Armor, we'll see how well I'm listening. The Cube Armor does inline enforcement, which means as the attack is happening, it's stopped before it even happens. And Falco does asynchronous enforcement where it's the attack happens, the bad thing happens, and then an alert alert happens and then some sort of effect happens. But the bad, it doesn't stop the bad thing from happening. Falco is still amazing because it's an amazing community with a ton of integrations. It does. There's a lot you can do with it. But that's the differentiator between those technologies. How we do it? Give us an insight into your world, into your debugging. What I'm going to do is what's famously done by anyone, I'm going to uninstall and install. Very sophisticated work happening here. It's a complex debugging process as you all know. We can all relate. Do you all have any questions to chat about while we're waiting on this part? Or, Brutus, is there anything you want to highlight while we wait? Something. One of the things was that probably these all information are not easily consumable for you. Why are so many JSONs flooding my screen or for letting my databases? I need something to aggregate for me. These are network calls that are happening. Walt is going to make a lot of any application with a liveness probe is going to make a lot of network calls. So is there a way that something is aggregated here for me? So K-Armor has a nice utility called profile. And if I go ahead and run that, I think, okay, I uninstall Walt so nothing will happen now. But what it will do is it will start aggregating counts for the same process that's happening for you. So if network calls are getting executed frequently, it's going to do that and aggregate it. We are going to see it once the world itself is starting to run. So when your active line is on the bottom, we can't see it from behind your name. Okay. I will have to keep that in mind. Yes. Yeah. Cool. But I will show you that profile using default namespace maybe mean while Walt is installing. So we did Walt. And we did apply a policy on an engine. So I'm going to do apt again. So, okay, apt was permission denied two times for me. The result was permission tonight. And the pin bash process was executed once. And I have network calls were made by Prometheus, sidecar injector. All these are getting aggregated for me. Okay. This has happened 18 times. This has happened six times. So all that metadata is aggregated for you here. Cool. And then all that's also getting sent to like via open telemetry to whatever your stack is. That's awesome. We have a question. We have from Jay. Oops. So this is a tangent if we need questions to kill times as Jay, you all mentioned BPF, LSM enforcer is app armor, LSM also an available enforcer. Yep. So cube armor uses and like as I said, LSM is under the hood and the project actually started out with cube armor using app armor as an enforcer. And we pretty much have first class serve for app armor. Because if you see today, app armor is being used quite heavily because app armor also integrates with port security context and Kubernetes. So people do use app armor to protect their applications. And they do it at some level. But writing app armor profiles themselves is hard. So that's where cube armor comes in that entire narrative that why cube armor is needed there. But why we are like betting more on BPF LSM is that because with BPF LSM, we are writing our own code to decide what is being enforced instead of translating our policies to app armor based profiles. And there will always be limitations in app armor provided like because we are it's another tooling that we can do only so much there. So we are we were being limited by what app armor has to offer. And that's where we are today. Like if we say BPF LSM and app armor have achieved feature parity. So any of the both of them you use it's equal for you. But as as cube armor progresses, we are going to add additional features which can leverage the powers that BPF LSM provides us. So that's I hope that answers your question. I can't see your command line over there. It's behind your name. Yeah, thank you. I tried to look into just taking your name off the screen. And I was having trouble with that. I can try to make it into an X. See if that works. No, it doesn't on both. Not just you. Okay, I took your name away. Off out of that. Oops. What's happening is that for some reason I'm not able to initialize what but we can still try and secure go ahead and secure world right. Based on what's happening, if and this is a good time to launch the armor profile that the policy wrote only applied to like engine next things that wouldn't be the thing that's causing Walter fail. Would it? No, no, no, what's happening is what is saying that I'm already initialized. But then the UI shows that you need to unseal me. I'm not an inch and inch initialized. So I'm not sure why the command line thinks that I'm already initialized. Got you. You see, so as I tried accessing the UI itself, I'm seeing that world has certain processes getting executed here, right? Been busy box is executing wall status been bought responding wall statistics vault itself is performing some statistics. So all that execution is happening around vault as it runs. So and that's getting aggregated here. And file visibility itself is on as well. That inside my wall directory, okay, home vault is getting access ETC password. These some of these are security sensitive application files that are getting access frequently. And then itself vault is having some network calls all together. But that's how a cube armor is aggregating it all for you. But you might say that this is a lot of information, right? And you see file accesses are already happening at much faster rate there as 2316. It's increasing very fastly. And I wouldn't want that even network, right? This network is already reaching 86 on my aggregated while it only just started. And that's not like you might say that that's causing some performance overhead as well. What I'll do is now we can modify what you what all you want to monitor inside a particular namespace. So if I go ahead and describe vault NS vault, everything is installed install inside vault namespace. You see cube armor, I have an annotation here saying cube armor visibility process file and network. So these are the three entities that we are monitoring using cube armor. By default, it's just cube armor process and network. I had added file explicitly so that we show that like, I could show you this nice view that okay, what's happening inside. But if I go ahead and overwrite this annotation, annotate NS, and go ahead and set it to none, it suddenly it will just stop increasing now. Nothing inside the vault names, it will get stuck at 151. It was increasing for you a lot of time, but now it's not going to happen. And if I go ahead and care my logs log filter all inside this vault namespace, even if I now execute anything, I suppose I exit and keep this in and ID and SH. I can't see what you're typing down there. Thank you. It's okay. We need a secret word, jelly beans. So all these accesses I'm making, but I don't have any logs yet, but I will go ahead and now annotate again. And I'll just now have process annotation. And I only want to get alerts for processes. And now if I go ahead and do an LS, voila, I am only getting process based executions now. So you can fine tune what you want to receive inside. I know that okay, I know I already know what all processes are going to happen inside. But the nice part still is that even if I now apply policies and visibility is off, QRM is still going to enforce and alert me when something is violated. We will try that out. What I'll do is we already tried out, you might say, we did a getting started guide, right? And we saw a sample application that I had, a sample policy that I had in getting started guide. But I want to, as a user, I don't know how to, what all policies do I need? How do I know what are the, how do I know that package management execution is a bad idea? I do I need to educate myself with all that and all that things. But you actually don't need to, we have a community like community maintained repository of policy. It's called policy templates. So community maintained policies for all of you such that you can explore here. But going ahead modifying each selector for individual application here is is going to be happy. So we that's where key armor shines again for us. And we are going to run key armor, recommend me policies for my name says Walter. So I'll just go ahead and run this. So it's looking for at that, for the community policies and seeing which ones might be applicable for your particular namespace. Yeah, and also updates it like so like I had last time I guess I asked it for recommendation was maybe six months back. So the current version was 0.2.3. It said me that okay, new version is available. The community has has much more policies now, I will update it for you. And then I'll generate it all for you. And here's, I have a report for that. I, I will reduce a font size a bit so that you can see the full report and zoom in according. But here, here are all the policies that the like that we have in policy templates, but it's tailor made for your application now. So I had two pods in one was the agent injector, and one was the vault itself. And I have all these policy that have CIS command line warming and impair defense. These are based on certain frameworks out there like CIS, MITRE, and NIS. These are all the compliance frameworks out there with security automation help use to like have compliant products. And QBAR can help you achieve compliance using these policies. So we will try one of these policy out, say that I have, I have a question. I have a question. So say I want to apply one of these policies, but I already have my, my application is already running in production, and I don't want to break everything. Can I, can I do this in like an audit mode or like some sort of monitoring mode to see whether whether the policy is going to break my application or how I might need to change my application, and then apply the policy for real? Definitely, definitely. So what I'll do is so there are two, so like essentially QBAR supports three operations that you can provide in our policy. One is allow, one is audit, and one is block. So what we are going to do was block access to certain things. But what I can do is I can run it in, keep it as audit policy and monitor if something is happening. So let's do that right now. So this is not allowing rights inside. We already see involved that ETC password was accessed by world, but that's a security sensitive file system. No one should be able to modify it.  What, what's the use case for allow? Why would you do allow? Allow? Yeah, I, I, I try to sneak that, I try to sneak out of that. And no, that's fine. But because that's the next part that I would have done after we would have tried that out. Okay. You can get to it when you get to it. You, we can have some suspense. You don't have to answer me right now. Okay. I like that. Yeah. So no spoilers yet. Okay. Let's say that. So allow is very powerful. And it's difficult to tame as a, but I'll keep all the spoilers once we try out the, these basic recommendation policies. Okay. So that's good. So my policy was right in ETC. Right. And I have this policy and I will edit it for you. We had block set here. What I will do is I'll audit it first so that we know you, as you said, it might break my system. So I will just set it to audit here. And QPC till apply the policy itself is live and exit. Just a quick point because we say, so as an enforcement works, even if you disable the visibility, right? We talked about disabling visibility just a while back. But because we are going into audit mode now, audit us to enable visibility. We tried to audit because audit is something, which is not like that's happening. That's a Q bar more feature. It's not something which is happening in line. So we need the visibility set to prove when we want audit to work. So I'll enable file and network back again so that the audit policy itself starts working. And CD at C LS. And what I will do is I will create a file now here. Okay. That's weird. I guess I did not change it to block change it to audit. So that permission was just denied because you have a policy in place that a file can't be created in that namespace. Yeah. Okay. We'll let's check the policy. We do have it in audit mode is a vault maybe that while you figure that out, I'm going to answer Luca's question. Maybe you can back me up. What are the best practices for managing managing sensitive application information in a containerized environment in a standard way using vault and cube armor correctly. For example, if you had to deploy a spring boot application via CI CD pipeline on Kubernetes, how we have it, it's longer. How would you manage his application properties with vault? For example, pass them the necessary information such as user password database connection, etc. Would you use config maps environment variables or anything else? I think that's a problem that's handled by vault itself. Vault provides an an ideal way both by vault as well as Kubernetes has a secrets operator which handles all this complexity for you that secrets are exposed in the correct way inside a particular so that your spring boot application here can access it out. What additionally cube armor can help you do is that wherever secrets are mounted, whether it be environment variables, config maps or volume mounts themselves, cube armor can go ahead and secure them all together. So they work together to secure things. So cube armor is securing at the system call level. And to be specific about a vault integration into Kubernetes, it can be done directly, but there are a couple of Kubernetes projects that help you do it. One is called external secrets operator. And that one will reach out to your vault API and then store the secrets you need as Kubernetes secrets. The other one is called secret store CSI driver. And that one reaches out to your vault and gets the secrets that's needed for a particular application and mounts it to that application pod as a temporary file system volume. And in both cases, cube armor can help secure at the kernel level. What's happening here is I guess something inside the vault configuration is blocking it here. But as we can see here, accesses are being made to vault. So probably a bad and it is working correctly because it's an audit mode. So as you said, if I would have applied this as a block policy, my vault application could have broken down. So using audit mode to monitor that I have zero alerts first is a good way to understand that if my application is going to break or not. My application is still safe because it's an audit mode. So that's where audit and block mode shines. What we will do is since we, so that that was the community part of it. Now we let's dive into how we are, what's the allow thing that I kept secret for so long. I was going to ask you to zoom in on this, on this terminal if you're going to use it. Yeah, I'm just going to do that. Cool. You see, because so many of it was getting executed, it said that, okay, just go, the bindings are now, a lot of binary inside bin is getting executed. So they are aggregated already. But that's something that profile is doing for you. The logs themselves are all as they should be. And you get both kinds of configuration. Thank you. So this is still a full information. And if you want to summarize information, you have it here. So that's where, but let's do one thing. I would want the full information just for some context. So while this loads up, what was allow policy? Allow is something, zero test is something that we have, we have like a lot, it is being talked a lot about in security, especially in cloud native security. Even if I go ahead and apply this policy templates, these are only helping me prevent against known attacks that these frameworks have like analyzed and created policies for me. But what about the unknown attacks? What if someone, something happens, which is not covered by these policies, there are only so many things you can go ahead and keep blocking, auditing, blocking, auditing that life cycle is going to be tiring for you. So that's where the allow policy comes in the picture. You can have zero trust policies created and enforced by Q bar one. So what's a zero trust policy is that I don't trust anything inside my container. What I want to trust is that, okay, I know that, okay, this is getting executed, bin vault, bin SS, bin busybox is getting executed. I'm just going to trust that and anything else that gets executed, no, I don't want it. I'll deny it. Makes sense. So that's, that's allow policy. But as I said, it's hard, right? You never know, okay, bin vault execute, I only saw bin vault earlier. And I created a policy saying that only allow process bin vault and deny everything else. Now, as soon as bin busybox get executed, my application is going to break. And that's where audit and again, audit mode is important. We'll see how we do that. And let's get this policy and I will write I'll, what I'll do is I'll just see into zp.yaml and let's so I already I'm taking this as a base policy so that I have all the required things. Vault zero trust. Action is set to block. I'll change it to allow now. And as I said, let's say that, okay, bin only bin vault is allowed to access nothing else. So match path and I'll say bin, bin vault. This was a point, bin vault was a process that we saw here. So I'll add this and alert untrusted execution detected. So that's my final policy saying that I only trust bin vault. Anything else go ahead and deny it. So cp and so we have this policy I'm going to apply it. And right now it should have broken it, but it will not break because by default, jubarmer keeps them in audit mode. Okay, I, okay, I missed something out. So, okay, read only something specific to file construct processes. So I have the updated policy. So zero trust policy created. And if I go ahead and even executing SS is already something which happened, right? And q, I guess qc, I'll delete the earlier policy. And if I execute LS here, okay, I have audit alerts saying that bin busybox got executed. LS is part of the busybox binary. Bin busybox is being executed. It's something that you should look into that probably your application still the zero trust policy is still not complete because you are receiving alerts, right? So take this and probably go ahead and add it. So I'll go ahead and add bin busybox now into the policy. So is this a normal framework for for profiling an application and monitoring it and then figuring out how to implement zero trust? Yeah, like this is what's the core core process of it. What I'm doing is in a very primitive way. There are tool, there are commercial toolings out there which do it in an automated way. Or what you can do is you can dump all the logs into some database or elastic search lookie and all that and have that entire profiling done and done from there. So a lot of things there. This is because I'm doing it in much more different way because I just wanted to show how at core level this works out. Love it. So now I've added bin busybox and I executed LS and I did not apply it. Configured, yeah. So I did not apply it. Never. So excited. LS and okay, no alerts yet. So LS is an expected outcome now. But let's check if there's anything else I can use which is not busybox here. Everything is busybox. Everything's busybox. But since file operations are allowed, I will be an attacker and copy vault into and rename vault into something else. Let's say test. Okay, I'm permissioned in that to do that already by QBAR. Okay, no, you cannot do that. So I guess I'll just ask you to trust me on this and say that if any other process is executed, it's going to be denied. You're ironically asking us to trust you about zero trust. Okay, no, I have some processes. Yeah. Okay, great. Yeah, show us. LDD, right? LDD got executed and I got the alert saying LDD was executed. But it is something that should not have been executed. So I will go ahead and annotate my name space saying let's set file posture equal to block. Now anything related to processes and files are going to be blocked inside this. And you see LDD is permissioned in it, but all my processes like been busybox and vault are working as expected and my UI would be working as soon. So that's how you have that entire zero trust policy lifecycle management for you that you can set it in audit mode per name space and change it to block mode when you see be confident that this is going to work. Awesome. Can you believe an hour? I was going to say an hour is passed already. It's flown by. I feel like I could do this all day with you, but we only have this hour. And I think maybe you covered a small fraction of what you hope to cover, but we just asked you a lot of questions. So I hope that you come back on soon and do some more with us because this was super, super fun. Is there anything you want to say in closing before I read the goodbye script? So, but like I already covered most of it and now I'll just add one pointer that I only did it for processes, but you can do this for file systems like how we were talking about entire securing the volume mounts and all that you can define which you can find great it at level that I can say which mount is going to be used by which. And I'll just show the final policy there so that you have an idea what it would look like. I'll say that okay, vault is going to be, vault is a volume mount inside vault. Lot of vaults inside. So inside vault, I'm going to block accesses to the vault itself and allow this vault access to only bin vault binary. We already see bin vault binary. And similarly, and this is something which we already discovered like bin busybox and bin vault. So this would have been the next part where we would have secured the volume mount itself. But now we already know the core concept of it that how to go ahead and generate this policy. And you have that entire lifecycle management of audit and blocks. So to help you out. So yep, that's all. We covered a lot of it and hope you all use cube armor. You start using cube armor to have armor up your clusters now. Where should folks go if they have questions after watching this video? Sure. So cube armor has its own slack. You can join us. This is cube armor.io. We have a nice go for it with a shield to help you project it. And you can join us, go ahead, use on GitHub. We have discussions. You can go ahead and ask questions there, create issues. That's one way of doing it. Or you can join our slack and ask us questions there. We have an active community there helping out everyone who is wanting to know how to how to start things here. So yeah, awesome. I appreciate you so much. And I appreciate all y'all in chat for asking great questions. Thank you for that. So thanks for teaching us about cube armor. And here at cloud native live, we bring you the latest in cloud native code on Tuesdays and Wednesdays. So at the same time of day. So thanks to you for being here. Thanks to Brune for presenting. Thanks to everyone who watched the recording. And please join us again next week.


If you own land, more than likely you've got weeds, and so it's the responsibility of landowners to control noxious weeds, as well as other weeds that might affect your cropping economics. When you're storing chemicals, it is to be behind locked doors, and you're also asked to put a sign or a sign up that indicates the pesticides are behind that locked door. This avoids anybody from getting in and maybe taking it or kids getting in close contact with it, that type of thing. So also, we're doing chemical pickup, and as you come to pick up your chemical, make sure that you store it on the back of your vehicle, out in the open, inside of the car. Also, make sure that if you're using flatbed pickups or trailers that you secure your load and you do not lose that in transport. Another mistake that we've seen is leaving your chemical unattended. If you're going to go out to your field and make an application, many people have basically chemical trucks that they store them in, and they leave them unattended for long periods of time. And there's been mishaps of chemical getting stolen, or if you really don't have neighbors that like you, there's been cases of people putting chemical in your spray tank, kind of as a bad prank. It's your responsibility to keep that chemical under lock and key and under your control at all times. Another one to keep in mind is that always store the chemical in its original containers, and you want those container labels to be facing outwards so everybody knows what chemical that they are exposed to. Also, when you're handling chemicals or transporting chemicals, make sure that you do have the proper safety equipment. In the event that there's a spill, you want to make sure that you've got some cat litter or some chemical to kind of absorb the spill. And then if it is significant enough that you report that to the poison control center and assist with control to your attempts to clean that mess up. Again, we hope that everybody has a safe spring season, and if you have questions, you're always welcome to contact your local extension office.


Hey, welcome back everybody. Jeff Frick here with theCUBE. We're in Palo Alto, California at a church-off event. It's called Security in the Boardroom. And it's really about elevating the security conversation beyond the IT folks and the security folks out in the application space and out on the edge. And really, what's the conversation going on at the boardroom? Because it's an important conversation. And one you want to have before your name shows up in the Wall Street Journal on a Monday morning for not all the right reasons. So we're excited to have a real practitioner, Rich Bates. He's the Chief Information Security Officer for Wells Fargo. Welcome, Rich. And accompanying him, Jason Cooke, who's a Managing Director with the Church-Off Group. Great to see you, Jason. So we talked a little bit off camera, Rich. You've been in a lot of different seats in this game, from consulting to now you're at Wells Fargo and a few more that you ripped through this that I can't remember them all. So from your perspective, kind of integrating this kind of multi-dimensional approach, how do you see this conversation changing at the boardroom? Well, I think most importantly, the board, it's a topic of discussion, one of the top discussions over the last couple of years. There's been a lot of guidance recently that's been put out to board directors through the National Association for Corporate Directors, as well as various consulting firms providing guidance. Board members need to be able to take this complex topic and simplify it down so they can do their jobs that's expected of them. And sometimes that can be a language barrier. So I think what I see happening is boards are beginning to hire individuals with some cybersecurity expertise. My example at Wells Fargo, we hired our retired general, Susan Votino, to come in as one of our cybersecurity obviously experts in the board. And it's great having her in that board seat because oftentimes she can help me translate some of the issues and gain a different perspective from the board. So that's a pretty interesting statement. So they're actually putting security expertise in a formal board seat. That's a pretty significant investment in the space. Well, but if you think about this, I mean, why? Well, most institutions today, when you break them down, are really technology companies that just a business platform rolls on. So security is becoming part of not only the institution today, but the institution of the future as organizations move towards digitalization. So having that ability to have someone who understands the risk management side of cybersecurity as well as the practitioner side will only make I think a board room that much stronger. So what's your experience in terms of trying to communicate the issues to a board? I mean, just real, just down and dirty. You know, where do you find the balance as to what they can absorb? What can they not absorb? How do you kind of outlay the risks, if you will, and how they should think about, you know, driving investment in these areas? Well, great points. But the first and most important thing with boards is gaining trust, right? That you have the expertise and you have the information. By no means could I bring all my data to a board meeting because it's just not digestible. So there's a little bit of an art of taking that down and building the trust and focusing on certain areas. But a point you made of things really important is, is one, you have to help them understand what are the top risks and why. But when you're talking to a board, you have to be able to say, and this is what we're doing to address them and here's the timeframe and here's the risk associated with this. Because in their minds, they're thinking, what can I do to help you? And then secondly, very astute point, but it was the decision regarding prioritization. In this particular space, there's always gonna be risks, but it's really the art of deciding which ones are more important. So I'll talk to the board and I'll highlight things like probability of occurrence, right? So the higher the probability of occurrence of something happen really drives our prioritization. Then Jason, from your perspective, right? You're coming in from outside the board, trying to help out. How have you seen the security conversation and priority change over time, especially in the context of this other hot topic that everybody's jumping on, which is probably the agenda item just before Rich comes in the room, which is digital transformation, right? We got to go, we got to go, we got to go. Everybody's evolving, we got to go, we're getting left behind. And then oh, by the way, Rich is going to come on afterwards and tell us what some of these risks are. Yeah, and I think actually Rich started to touch on it. So all organizations, especially when you're looking at the Fortune 500 and around that shape and size, are global and they're all in a digital journey. Whether they acknowledge they're actually a digital product company, all of them now digitizing is happening. So as a result of that, security is an absolute critical component of anything linked to that for all of the reasons that you can just read the headlines around. And actually at the boardroom level, it's more now hopefully becoming a conversation that's about how do we as board members take responsibility and accountability for how to protect our organization? And it's framed now more and more so in a risk management conversation rather than just saying security. Because security is outside when actually the reality is security and cyber activity because you're a digital organization is embedded into everything whether you realize it or not. So the board needs to be educated to what that means. How do you take risks in the context of digital activity and assign it to a risk management program approach rather than just saying it's the security guy that's got to come in and do that. And the security guy is most probably gonna be the guy that absolutely has to understand that boardroom issue and then execute upon it and bring options to the table every time in and around that space. But the main message I would say is take this from a risk management perspective and start using language like that. And that's probably the other point that we were discussing just earlier in the security series today that actually it's about risk management and educating everyone very clearly as to what do we mean? What are we actually protecting? How are we protecting it? And what are we doing as a set of board members and as a leadership team to actually take forward enablement of the business from a security perspective understanding it but then also protecting the business. Right. So are you building models then for them to help them assign a value to that risk so now they know how much that they have to invest because the crazy about security I'm sure you could always invest more, right? You could always use a little bit more budget and there's a little bit more that you could do to make yourself a little bit more secure than you were without that investment but nobody has infinite resources. So as you said that bad things can happen it's really risk mitigation and kind of knowing the profile and then what you do about it. So how do you help them model that? I can answer that and I know Rich can jump in. So what you're seeing is a brand new leader role emerging from the traditional IT security guide to now the guy that isn't all or person should I say more accurately that's engaged at the boardroom that's there to talk about risk in the context of how the board sees it. And so what does that mean? It means that absolutely you need to know what you've got from a digital perspective everything from the traditional network to all of the IT assets and everything there and the key thing is you need to know what you've got but you have to then contextualize all of that against business risk and pulling those two things together is the challenge that you see across the industry today because they have been silos and usually underneath those silos are many other silos so bringing that together is really important and I think if you look at how we're gonna see disruptors in how things are managed in a risk management perspective actually that's what you're gonna see come together how do you bring those models together to give actionable intelligence that the board can react to or predict against and that's not an easy thing to pull together. Yeah and to take it kind of more down to a tactical arena so at some point like you said you can't just keep asking for more money because you're not practicing good business attributes because everybody could ask for more money so I think as organizations mature their security programs they're gonna be able to go to the board with issues like this. Endpoint security, right? There's so many different endpoint security products out there that you could buy but if you're practicing good risk management you're starting off by saying what is the risk? Let's just talk about malware. So malware is the risk. Well how much malware gets to your endpoint? And let's just say in this particular instance you're here.  And then when you do that and you walk into a boardroom and you can show them that and then you say this is kind of our risk appetite because we're never gonna be able to reduce it. But I could go spend some more money. I could go spend five million more dollars but I'm gonna move it this much. I'd rather take that five million, move it over to this risk which is right here to reduce it to that area. So I think that goes hand in hand with what Jason's saying but when you can get to that level, to the board to help them understand your decision, they have a greater comfort level that the money is being spent in prioritization is occurring. Yeah. So go ahead. If I may. So one of the things that you just touched on I think is really useful for us to kind of expand upon more. One of the advice points Chertof Group had in our series session was around bring in cybersecurity experts to the boardroom. I know obviously you're very active in the whole finance sector providing advice and direction in that space. Can you tell us more about that? Sure. So in particular what in my role also as the chair of the Financial Services Sector Coordinating Council, what we do is we work closely with the government with policy and doctrine and then the FSIS Act Financial Services Sector Analysis Center is the group that really goes out and kind of operationalizes it through information sharing and the FSARC. But what we've seen is a desire to have honestly more security professionals on boards. So CISO is potentially being asked to sit on public and private company boards to provide that expertise back to the company so that the boardroom can help understand and transcend what is going on. And again, from my standpoint I feel very privileged to have one of them on my board today. And she's been just a wonderful addition. Not only does she bring cyber expertise but being a retired general brings a lot of it to other additional. So I would predict we'll see more and more CISOs being asked to sit on public and private boards to bring that perspective as the business models move to digitalization. We could go on forever and ever and ever but we can't unfortunately. But I have one more question for you Rich. Is kind of this change in attitude amongst the CISO community and other people at Deals Security in terms of sharing information? You mentioned you're on this group and it used to be we didn't want to share if we got attacked for a lot of different reasons. But there's a real benefit to sharing information even across industries about the profile of some of these things that are happening. How are we seeing that kind of change and how much more valuable is it to have some other input from some other peers than just kind of you with your jewels that you're trying to protect? Sure, so in general from an industry standpoint the financial services are much further ahead than a lot of the other industries because we've been doing this a long time. So sharing occurs officially through the FSIS Act but also you'll pick your phone up and call a friend right away and say hey I've just seen some of your IP space associated with so and so. So that informal sharing is there. It's a very tight community and particularly from the financial services we don't think of security as a differentiator necessarily because the reality of it is when an adversary chooses to point their direction at you it's just a matter of time before they get around to your institution. So sharing occurs and secondly the government's been doing a great job of trying to break down as barriers, work through all the issues that are related with sharing of classified, unclassified information. So there exists a model today that seems to be working pretty well, formal as well as informal and if you look at some of the past history that sharing has really helped a lot of organizations. So I see it only getting better and better as time goes by. And the point I would add to that is the financial services ISAC for example is one of the most mature out there. In fact is probably the most mature at a global level out there but that's taken time to establish the trust and the collaboration there. And the one recommendation that we would all give out to the industry as a whole is you need to be getting those type of things stood up and you have to invest time into them to generate the collaboration and trust. You're not going to get it overnight but you have to start somewhere in doing the same because really what good work is happening here needs to be happening across the global industry as a whole. Right. All right Rich, Jason will have to leave it there unfortunately, really great insight and thanks for sharing your insight with us. Thank you. All right, I'm Jeff Frick, you're watching theCUBE. We're at security in the boardroom with the church off event in Palo Alto. Thanks for watching.


Hi, this is Tony Appleby with the Project Management Institute and I'm here at RISE 2019 in Hong Kong. And I'm delighted to have with me Guy Dietrich, who's the Chief Innovation Officer over at Cisco Systems. Welcome, Guy. Thank you. So you've given a couple of presentations during your time here. Can you tell us a little bit about those and what are some of the takeaways from those that we should have? Well, I made two presentations. One was on learning locally and acting globally. So it's a fascinating subject because we're doing a program called Country Digital Acceleration, which works with countries to help them digitize faster, to help execute on their national digital agendas. And so I was able to share some of the inspiring stories from around the world of the impact digitization is having on communities. And then the second subject was around the challenges associated with digitization and some of the things that we're taking on around the world at Cisco, such as inclusion, access to education, access to quality health care, and some of the programs that we're doing to help address those issues. Well, that sounds really intriguing. Can we dig into those just a little bit more? Sure. So if you look at a project that we have, for instance, in Saudi Arabia, it used to be that if you were in far southern reaches of Saudi Arabia and you felt ill and you needed to get to a doctor, you had to travel to Riyadh to get first quality health care. Now, because we are able to connect local clinics right down the street from people's houses, we can connect them to the MD Anderson Cancer Center in Houston for their oncology care. We can connect them anywhere in the world through distributed health care. And that's just one example. We've got 370 projects active or completed around the world related to digitization. That is truly impressive. We're seeing a lot of that here in the conference, that innovative thinking and approaching things from different angles that we have historically, incremental building is tearing everything down and starting afresh. Are you seeing a lot of the same similar? Absolutely. The amount of disruption that's going to happen over the next decade as we go from 25 billion connected things to 500 billion connected things, it's going to be monumental. And it's very exciting. And so with all that disruption, what are the types of challenges that organizations and individuals in those organizations are going to be facing and what would you suggest they do to prepare for it and address it? You know, I think the primary thing that people should understand is that there shouldn't be a distinction between being a strategic profitable company and serving your community and giving back. That the best run companies with the strongest leaders realize that those things are complementary. And it invites all sorts of new opportunity for companies to give back but also to allow their employees and to allow their customers to be proud to be associated with them. Nice. So in talking about strategy, a lot of bright lines, thought leadership is specific to helping organizations be successful in strategy delivery. Can you tell me just a little bit about how you're being successful with your work? Yeah, so we'll talk about this country digital acceleration program again. You know, one of the challenges that we had in initially getting this started is that governments work in silos. They have their own individual silos that typically are surrounded by walls that are then surrounded by moats and nothing leaves and nothing gets in. Well, in order for our programs to be successful, we have to cut across that. We have to cut across those silos and bring them all together in order to deliver on these country digital acceleration programs because they're very large, very complex. And one of the things that we found that has been most impactful is that we run a workshop and in that workshop we combine strategy and we combine execution and budgets all in the same project, all in the same program. So when we emerge from these workshops, they're ready to get started right away and there is not a distinction between strategy and execution. Nice, nice. So in these environments, you know, people are probably having to learn and adapt quite a bit. I should like to know from your perspective what would be the number one skill or trade or knowledge bit that a worker should have in order to be successful. You know, the common answer is always around agility and flexibility. I would actually add in their patience and to be able to be patient in this ever-changing world I think is an advantage. I'll give you an example. When we think about 5G, everyone refers to it as a race, right? It's the 5G race. It's not a race at all. When you think about a race, you think about a sprint. Whoever gets to the finish line first wins. That's not how the information age worked. It's not how the internet became pervasive. It was gradual. It was strategic. It was thoughtful. And it's going to be the same thing with 5G and it's going to take patience. This idea somehow that one company, one country, one continent is going to own 5G. And it's just a mischaracterization. If someone has to say it's a race, I'd suggest that it's a marathon. And we are in the first 10 yards of the 26.2 miles. Nicely said. I appreciate your time today, Guy. Audience, thank you and thank you, sir. My pleasure.


Master's degree, the master's degree is an academic degree awarded by universities or colleges upon completion of a course of study demonstrating mastery or a high-order overview of a specific field of study or area of professional practice. The master's degree normally requires previous study at the bachelor's level, either as a separate degree or as part of an integrated course. Within the area studied, master's graduates are expected to possess advanced knowledge of a specialized body of theoretical and applied topics, high-order skills in analysis, critical evaluation, or professional application, and the ability to solve complex problems and think rigorously and independently.


You don't have no outside investment, but all the time we have people speaking on inner city problems that have no vested interest in the subject that they're speaking on. Well, and I'm glad you said that. I was listening last night and I listened to Vlad and I listened to Nojompa22, Adam22, who have big platforms in California and all night and she heard, you know, I was listening to that last night and the thing that stuck out to me the most was how much they spoke on all of the killings and it was mostly all of it was black people, everything that was going on in the black culture, the black community. They were speaking on it cause they had been on a show. Either somebody got arrested after they left the show or either they got killed when they left the show, uh, you know, just after they left that show. And how much does going on these platforms like mine and every, how does that, well, it brings awareness to it, but does it really help? Well, as far as bringing awareness, but once again, life imitates art and these youths cannot see down the line, like for me, it took me a 60, 50 years to learn choices in life right for wrong, but when you're out there in them streets and this is, they see that stay only way out. They're not looking at the, uh, adversities involved in getting away.  Uh, and it's just sad that, uh, we as a race are hurting each other at this alarming rate. Wow. You know, and just since, since here recently here in Texas, I know y'all and I was going to ask more of this, but I'm going to ask you, man, uh, Travis Scott, man, we had a tragic deal to happen out in Houston where this whole, uh, concert was going on and, and they ended up blaming him, uh, for these, uh, situations that happened, uh, the deaths that were going on and it's crazy how that happened. But I look at, I look at that and then I look at, I even look at Jason Aldean and what, when the people got killed up there in Las Vegas and I'm like, was the same, would the same narrative be for Jason Aldean and country music as it would be for a, you know, for, uh, uh, Travis Scott in Houston, Texas, a little insight on Travis Scott, uh, cause he got canceled from the weekend in Las Vegas. I've seen that, right? But, uh, earlier this morning, I heard from a, my nephew, Joey Badass, who will be performing the night out there and they had asked me what's out there to come and, uh, security is real tight, but we also have a video, uh, prior to the, whatever, trampling or whatever the outburst where the people that were injured and, uh, uh, condolences to those family members that lost. They love one and God's healing grace for those that are in the hospital because, uh, like I say, I don't like to see no parent or somebody hurt. But at the end of the day, uh, a lot of times, uh, you're getting castrated by the media, uh, and they look for a way to take you down, but they have video where the young man had, uh, Travis Scott allegedly had, uh, stopped the show to ask to, uh, help, uh, somebody, prior to that way, seeing somebody injured. And one thing about the law, and when we go to this, you got negligence, not intent. If this man didn't know what occurred there for, he went to an after party for my information. He didn't know nothing about it. So he's not aware of what happened. He cannot be held accountable. No more different than when Trump, they try to say Trump had a march up on Washington, but didn't happen to me. Yeah. See those with money get just us and then it's just us.


In this session we shall be introduced to disaster risk reduction as a key role in public health emergency preparedness. Remember disaster risk is defined by hazard times vulnerability minus capacity. Vulnerability to natural disasters. 95% of natural disaster deaths occur among the 66% of the poorest countries. From 1965 to 1992 more than 90% of all disaster victims lived in Asia and Africa completing the disaster management cycle. The cycle includes preparedness, response, recovery and mitigation. This is an evolution in approach from response and relief to risk reduction. What is disaster risk reduction then? It is the conceptual framework of elements with possibilities to minimize vulnerabilities and disaster risks to avoid, that is prevent or limit, mitigate and prepare for the adverse impacts of hazards within the broad context of sustainable development. Risk management includes mitigation, preparedness, response and recovery. Risk reduction on the other hand includes mitigation and preparedness. Risk reduction is more efficient, more cost effective and more humane. This is the risk reduction cycle from vulnerability analysis and hazard analysis to risk assessment, to risk reduction which includes hazard mitigation and vulnerability reduction and this results in sustainable development and the cycle repeats. The figure presents an approach to risk reduction. The integrated emergency management approach involves hazard identification and risk assessment plus vulnerability analysis which leads to setting priorities. This goes to mitigation prevention strategies to reduce impact of disasters. This continues to getting ready to go if the hazard remains. This results in preparedness education, contingency planning, effective response and fast recovery. All this is underlined by feedback at all stages. Preparedness is actions that result in persons knowing what to do and how to respond after disaster has occurred. The approach to preparedness programs is that it is a long time, it is part of a larger risk reduction program, comprehensive application of sustainable development, all hazards planning, it should be multi sectoral, it should be user friendly and culturally sensitive and specific. Objectives of emergency preparedness include preventing mobility and mortality, care for casualties, managing adverse climatic and environmental conditions, ensuring restoration of normal health, re-establishment of health services, protecting staff and protecting public health and medical assets. Mark Kane of CDC proposes 11 years of emergency preparedness including economic incentive, epidemiology, enforcement of codes, emergency plans, equipment stop piling, education, exercise and drills, early warning, evacuation, evaluation and the use of electronics, e-health, risk management. What is risk? It is the probability of suffering damage to life, property, economic disruptions and environment from a hazard for a given area and reference period. Risk is the product of hazard and vulnerability. Risk management is defined as the process of identifying, analyzing and quantifying the probability of losses in order to undertake preventive and corrective actions. It involves mainly two types of activities, planning actions to reduce vulnerability in areas where risk can be controlled and establishing protective mechanisms against the potential economic losses from uncontrollable factors of natural hazards. What is disaster risk management about? Disaster risk management entails efforts and measures put in place to reduce risk in case of a disaster happening. It is also about commitments related to disaster and vulnerability reduction and improved early warning. Since little can be done to reduce or eliminate the occurrence of most natural disasters, actions and activities should focus on reducing existing and future vulnerabilities to damage and loss. There are three primary and interrelated categories of risk management. Risk identification, risk reduction and risk transfer. These are mostly related to the pre-disaster phases of disaster management. The pre-disaster phase of disaster risk management involves four distinct but interrelated components. Risk identification, risk reduction or mitigation, risk transfer and preparedness. Risk identification is a thorough analysis of existing vulnerabilities, location, severity and intensity of threat. The following activities help to identify and understand natural hazard risk, hazard data collection and mapping that is with regard to frequency, magnitude and location, vulnerability assessment, population and assets exposed, risk assessment, probability of expected losses, risk reduction of prevention and mitigation and measures taken to eliminate or reduce the intensity of a hazardous event. These measures address existing vulnerabilities through measures like early warning. They include actions such as implementation and enforcement of building standards, environmental protection measures, resource management practices and the population control of population activities that be disposed to risk. Key issues to note on risk management include even when effective disaster reduction measures are in place there would often be an element of risk that is residue. Preparedness is an important component of disaster risk reduction which deals with residue and unmanaged risk. Risk transfer are mechanisms which aim at reducing active vulnerability, the financial risk in order to ensure that funds are available when loss occurs from a disaster happening. Risk transfer mechanisms are often inefficient from cost perspective so it is important to take all the necessary measures to reduce the vulnerability of assets to be covered before transferring the risk. Without getting into the details the main risk transfer, risk financing methods include market insurance and re-insurance. This insurance provides coverage for damage and expenses that are beyond the potential for budget self-insurance. It involves paying or contributing premiums to an insurance company and the premiums are calculated in a way that they spread out the risk. This is not yet possible in many developing countries. Risk transfer mechanisms also include budget self-insurance where a small proportion of the budget is allocated to be spent on improved maintenance. This can be done at a local government level, agency level and even household level. It also includes compensation policies and they should target the most vulnerable populations and causes of vulnerability. Community insurance includes cooperatives, community savings groups, community granaries, community policing and resource conservation. This is a viable mechanism of risk transfer in resource constrained countries and societies. There are also household livelihood insurance mechanisms like savings, food security, proper settlement and modern methods of production. The Hyogo framework for action assists the efforts of nations and communities to become more resilient to and cope better with the hazards they face. Although the primary responsibility for its implementation rests with government, collaboration and cooperation between all stakeholders in managing risk is crucial. The Hyogo framework for action commits governments as well as regional and international and NGOs to ensuring that disaster risk reduction is a national and local priority. Identifying, assessing and monitoring disaster risk and enhancing early warning. Using knowledge, innovation and education to build a culture of safety and resilience at all levels. Reducing the underlying risk factors and strengthening disaster fairness for effective response at all levels. Community, subcount district, regional and national levels.


Okay, welcome back to theCUBE. This is SiliconANGLE and Wikibon's exclusive coverage of HP Vertica Conference, HP Big Data 2013 is the hashtag on Twitter. I'm John Furrier, the founder of SiliconANGLE. I'm Joe with my co-host. Hi everybody, I'm Dave Vellante at wikibon.org. Lawrence Schwartz is here. He's the vice president of marketing at Attunity. Lawrence, we know you, of course, from Tokentech. Welcome to theCUBE. Good to see you again. Glad to be back here. Yeah, so it's an impressive event. When I first heard that HP was going to have an event in August and it's the first user conference, I wasn't sure, I said maybe they'll get 100 or so people here, but 500 users and 700 people, it's pretty good. So anyway, again, welcome. Tell us what you're doing at Attunity and what you guys are all about. Sure, sure, no, glad to be here. And yeah, we're very happy with the turnout as well. Yeah, awesome. We've gotten to work with them over the last couple of months and gotten to know them well. For what we do at Attunity, we've actually been around for a while. We've a company that got our history and changed data capture and working with that on a lot of different data types and data systems. So we were doing stuff with HP and non-stop, for example, for a decade or more now. So we know the guys well. And what we've been focusing on as of late is really how you get real-time data integration going. So when you want to have multiple data sources coming into a data warehouse, how do you move the data in there efficiently, quickly, without a lot of development effort. And if you want to do real-time BI and really look at offloading queries and things like that, those are the things that we can really help with simplify the whole process. So what we're here to announce is our partnership with Vertica, that's part one of it, and part two is having a product that supports the vertical offering and being able to do this. We do this for many other types of data warehouses, but we're very excited to be able to do this for Vertica as well. So I wonder if you could talk specifically about how data is changing. Everybody talks about unstructured data. 90% of the world's data is unstructured, but I wonder if we could sort of double click on that a little bit. How specifically is data changing and how is the industry generally in attunity specifically taking advantage of that? Sure, sure. Well, I think what you find is that there's data residing in many different places already existing within on-premises and moving it around there is a key question. The different data types that are now available, as you mentioned, are structured and unstructured. There's different types of content as well. You're talking about social, you're talking about HR records, you're talking about traditional data stores. So how do you move those all in to a place where you can do sufficient analysis on it, have the horsepower to do that? And that's what we support. So you've got Vertica as a fantastic platform, for example, for doing all of those analytics. And then, of course, everyone talks about the need for data scientists on top of that to run it. But what I think it's less talked about is how do you get the data in there in a timely fashion? How do you manage it from multiple sources? And not just the traditional ETL process, which a lot of people are familiar with, Exchange, Transact, move it and load it and do that type of work. But also, how do you move it more efficiently, do more of an ELT type of process? And we can do that very effectively. So when you talk to customers, who owns the data strategy? You know, you hear this talk about a data czar, we were at MIT a few weeks ago, and we had a discussion about the chief data officer. Do you see organizations thinking about that, or is it more technology led today? Sure, sure. No, I think it's very much driven by the users of the data, and what they want to do with it. So again, there's that kind of need out there to get somebody to manage all different types of sources, all different types of data and kind of synthesize it together. So those, I think, are driving the real demands now, not just the IT departments that had traditionally to take care of internal records, right? So they're driving those external demands, and that's what's driven, I think, a lot of the growth in platforms like Vertica for doing the analysis. And then what's helped us grow underneath that is managing all those different types of data coming in. So yeah, there are different drivers today than there were a few years ago. So do you think a role will emerge where there is sort of an individual or a group that is responsible for the data architecture, the data direction, the data strategy, or do you think that will be more distributed? You know, maybe, obviously it'll be both models, but what are you seeing? Is there any, do you have any evidence of any kind of trends emerging? And what do you advise people? Sure, sure. I think the bigger organizations out there will develop those, you know, companies in season house and bring in the people internally. I actually see for smaller companies, there are some very creative companies out there that'll help make that whole analysis process a lot easier, right?  They can be very challenging for the traditional SMB, you know, 50 to 100 people figure out how to use that data and make the best of it. And so I think there are a lot of external agencies that can kind of come in and help do that type of work, you know, with their products, with some consulting. And so that might not be in-house for a smaller place, but there are some great tools developing for that, that side, as well as the bigger places with the in-house technology. So you always heard a lot about, you know, the single version of the truth that was sort of the promise of a lot of the data warehouse and business intelligence systems that have been put in place in the last decade. And then, you know, this dupe thing comes along and people say, oh, we're further from a single version of the truth than we've ever been. What's your take on that and how are you and your clients wrestling with that problem? Yeah, yeah. So I think, you know, Hadoop and some of the unstructured capabilities out there get to a fundamental problem, which is a lot of people don't know the questions that they want to ask, you know, a priori, right? You know, it's not necessarily setting up, you know, no offense to the name theCUBE, but people, that's the honest, I want to start with theCUBE, you know, for the data warehouse. They just want to have access to the data and be able to ask the right questions later on. CUBE's good for video, but it's not always great for data. Exactly, there we go, that's the way to think about it. But, you know, once you have the power to really do, you know, move the data to where you need it to get to, have it on a powerful analytical platform and then be able to ask the questions, then be able to do the transformations and whatnot, those are different ways to think about it and offer a lot more flexibility than just the traditional model. So I think that's what allows people to do is to deal with the questions as they think of them and sort through the data, whereas you don't have to think about it as much beforehand and it gives you a lot more flexibility. Lawrence, talk about some of the use cases, Colin was on here, obviously it's a user conference here, what are some of the use cases that you're seeing with your customers and why the partnership with Vertica and why is that important? Yeah, so I think when Colin talked this morning in his keynote, he talked about the different pillars of the technology and what's important. One key aspect of that is, again, how do you get the data there and move the data over, right? So that's the leg that we're really helping Vertica out and I think what makes it a very interesting, symbiotic relationship, which is they've got a powerful platform, we've got the capabilities to move it there. So typical use cases are if you look at somebody that's got traditionally lots of different sources, they're trying to do real time analysis on it so they're kind of offloaded from some of the other data warehouses that they have, do the queries kind of maybe real time in a Vertica type system. So that's one area, the other part is just straight loading. So I can give you some examples that we've had with other data warehouses in general because of Vertica is just a new partnership for us. But in general, we work with places like on the finance side, you take like Equifax, right? And they have all the consumer credit data that they're looking at. And again, they're pulling it in from multiple data sources. The key advantage for them is they want to be able to look at it and do analysis in near real time. And that's something that you can't do with an ETL process, right? Just move it over, batch it, get it over there overnight, right? If you want that in near real time, we see that happening in manufacturing as well. So when you look at, we have another company, Smart Marginal, in the manufacturing space. And what they do is they're pulling in all their distribution and another information on the manufacturing process from service from all over the world. And then they want to do that near real time analysis of it and what's going on. And getting the capability to pull in the data from all those sources is critical. Talk about some of the BI challenges out there. So you have old way that has software inherent software that's based on slower compute, slower access methods. And so that's old. Now you have Vertica and other folks enabling basically low latency, massive speed, trillions of rows, billions of rows. So that goes away. That's going to change the software architecture. What do customers need to know about the different approaches to BI? There's companies like Plattfora, that Looker, you guys. And there's a variety of solutions. What should they be thinking about? What are the core questions that they should ask themselves when selecting a vendor in the BI space? Yeah, yeah, well it's a great question because there's definitely a lot of different stacks to the BI space. And we're very focused on getting the information in there so we work with all those types. I think being able to analyze the different types of data sources quickly is very important. I think what's also critical to this is a lot of time with these more powerful platforms, you got to start thinking about what you can do with that power that you have in the platform, right? So one thing that you have the capability to do now is get the data in there as quickly as possible. And then you could do your transformations and other things as you need to do them later. So that's kind of one thing that you could then do and then that gives you the flexibility to ask questions as you need to or as they come up. The other thing that you need to think about or the customers need to think about with any kind of BI stack that they choose is, it's great if you can find the data scientists these days to actually fill in that slot. It's great that you have the platform. But when you want to pull in a new data stream or pull in new sources, if you can't do that flexibly, then all this computational power you have, all this brain power, all the data scientists you have, it ties their hands and limits their ability to do things. So you really got to find a full stack. So diversity of sources and then as one issue. And then there's also new sources on top of that that come in in real time. Yeah, exactly. It's the new sources and actually getting a new source up and doing all the scripting that you might do with a traditional ETL. That can actually take months of developer time. It's very, it's not very well automated. So you want to find something that can automate that whole stack. So again, it's that time to value as quickly as possible with the different information sources. And it's not like a geeky coder. It's like a normal user. That's the key in the front end. That's the key thing. And that's what we especially help with. A lot of the setup for moving over databases can be complex, right? You're moving over schema. You're trying to change things and try to set up. But we actually make that a, we call it a click to load interface. And it's literally a few clicks on a GUI interface. Because again, we want to make that as simple of a process of going from different types of databases into where you want to get it so you can actually do the analysis. So what's your core innovation that you guys are enabling with your product? What's the core innovation? Absolutely. So there's a couple of things that really drive what we do. One is that simplified interface, which you might ask, well, anybody can do a simplified interface, right? But what really differentiates what we do is we've been doing this for well over a decade working with all different types of data sources, everything from the oracles to SQL servers out all the way back to mainframes, right? So being able to do those transformations and understand those interfaces and being able to speak all those languages as we will from different databases, that's kind of some of our core IP. And being able to smooth that and make that behind the scenes so you don't have to worry about it. The other thing is the speed and performance, right? So when you look at, for example, streaming data over and moving it from one place to another, people traditionally use change data capture to do that. But that's more optimized for most databases today around a transactional system because we're talking about data warehouses, we actually do a very efficient kind of packing of information before it comes over. So every time you send something over, you can actually get more efficiency out of it and get it near real time. The last thing that we do that's very different from what you might see in an ETL solution is when you go from database A to database B, instead of having to kind of touch down and move everything and transform it and move it over, we keep that as lightweight as possible. In some cases, just doing complete in-memory streaming. And again, that's much faster, less equipment that you have to buy and set up. And again, simplifying that whole process. So why the partnership with Vertica then? What was the big aha with Vertica? Yeah, yeah. So I think for us, we want to be able to work with the best in class solutions out there. We look at customers today, when they look at their data environments, they're really picking and choosing the best solutions that they can for different parts of the databases, the data warehouses they do, and we see Vertica coming up more and more. So we want to be part of that from our end. And then I go back to the value that we really deliver for Vertica, which is again, simplifying that process, not making it too developer centric and getting it into the Vertica databases or data warehouses quickly as possible. I think that's a high value for their organization. So really, it's very useful for both of us. How about data like video data? Or even metadata, that's either specific to video or maybe we have a general metadata discussion. How are customers looking at solving that problem? I mean, it's a hard one, right? You can transcript the video and then you've got the words, but is there anything on the horizon that you see that is going to allow people to conduct more analysis? You've seen a lot of video surveillance. It's sort of the new wave. I think we could talk about that a bit. Yeah, well, it's interesting. From where we see video from our end, and this is actually another area that we've seen a lot of interesting growth for us, is people are using the cloud a lot for their video assets. So if you have organizations that are spread worldwide and they wanna manage the video transfer and how they move it around, the cloud's becoming more popular. So for example, we'll work with Amazon S3. We have a very big partnership with Amazon Redshift. So all those things that I mentioned that are hard to do on-premise, moving those files, and we work with a good number of those customers for us are in the media and entertainment space, it's moving those large files into the cloud. Now what becomes a bottleneck right there, right, is that whole, how do you make the best use of the links in the bandwidth? And our technology's been optimized to do that on-premise and we've optimized to do that for the cloud as well. So that's at least our picture of the video world and where we see those pieces moving. What's the nature of the Amazon and generally in the Redshift, specifically relationship? Sure, sure. So we are a partner of theirs. We've been invited to a lot of the webinars they've given recently. We have a lot of joint customers and particularly, we have it on S3, we have it in multiple areas for the cloud, but particularly when you look at the Redshift side, which is basically their data warehouse in the cloud, they've looked at how do we make that more performant? How do we get data in there more quickly? So I'll give you one example. One of our customers is domain holdings and what they do is they do all that online registration of domains and they try to do the optioning and all these other real-time processes they want to run. So that goes back to our real-time need and real-time effort and capability. The question that they had is, okay, I've got lots of different data sources. It's a big amount of data. They looked at a project that was going to take them three months to move it all over. With us, they were able to do it in minutes because we're that simple and then getting it all set up and going and that's the value we bring for Redshift in the cloud, so awesome. All right, Lawrence, we'll listen. I really appreciate you coming on. We're going wall-to-wall here, John. Bruce Yen is up next from, yes? Good, we'll get to see Bruce again. We have a good comfortable experience with Bruce. Absolutely. It'll be great. We'll be right back after this short break, which is exclusive two-day coverage of HP Vertica's user conference. The hashtag is HP Big Data 2013. We're watching that. So if you have any questions, hit the hashtag. We'll be right back after this short break.


What's going on guys?