We turn to our next item of business, which is topical questions, and our first question is from Murdoff Reiser. To ask the Scottish Government what its position is regarding the performance of Scotland's rail services and what action is being taken to improve provision. Cabinet Secretary, Michael Matheson. The on-going train cancellations and capacity challenges in the east of Scotland, particularly across Fife, are unacceptable to the Scottish Government and passengers alike. I made this very clear to Abelio ScotRail and Abelio's Dutch Government owners, with whom I met recently. A stress that action must be taken immediately to reduce the level of train cancellations and complete the driver training programme for the new and refurbished trains. Transport Scotland officials are also in daily contact with ScotRail senior management to monitor closely the training programme and review the anticipated train cancellations. I will meet Alex Hines tomorrow and seek further assurances that there is a strong focus on improving performance in the east of Scotland. Murdoff Reiser. I thank the cabinet secretary for that response. As he pointed out, there has been a particular problem in Fife over the last few weeks and I have been contacted by many angry constituents raising concerns about the level of service cancellations. On the 16 April between 4 and 6.30 pm, no fewer than five Edinburgh to Fife services were cancelled at the peak commuter of time, leaving leading to what one constituent described to me as unsafe overcrowded conditions on one of the other trains. ScotRail claimed that cancellations are due to staff training, but is there any other provider of a public service that thinks that the only way that they can train staff is by cancelling the services that are available to the public and making the public unsafe as a result? Surely that is not acceptable behaviour. As I said in the chamber, on the number of occasions in recent times and also at the rec committee when we were considering the remedial plan, the performance that we have from ScotRail at present time in relation to cancellations, particularly in areas such as Fife, is unacceptable. The very reason that remedial notice was issued was because of the levels of cancellations on the Fife route. I fully expect ScotRail to implement all the actions that are set out within the remedial plan. They are now part of the franchise agreement to ensure that we start to see improvements being made. The member will be aware that there is a complex variety of reasons as to why ScotRail will find themselves in the situation around training with the late arrival of the refurbished and also the new rolling stock and also issues in relation to the way in which staffing and crew levels have been managed in the east of Scotland. Notwithstanding the issues, it is unacceptable. That is why they were issued with the remedial notice. I expect them to fully implement those so that those passengers in the Fife area and the east of Scotland see the benefits from the very significant investment that we are putting into rail in Scotland. I thank the cabinet secretary again for that further information.  We have been told for weeks and not months that services are going to improve, yet what they see are services that are deteriorating. One month ago, the First Minister said in the chamber that ScotRail was drinking in the last chance saloon. Why is the Scottish Government going to call last orders on that? The member will be aware that, if he is not in the remedial plan, there is a timeline for each of the actions that they must take, including additional recruitment of drivers and conductors and the completion of their training of staff. The training of staff is a key aspect that has an impact on commuters. The east of Scotland is due to be completed for the timetable change on 19 May. Transport Scotland in its engagement with ScotRail has been given assurances that ScotRail will still expect to complete that training programme in that timeframe, which will provide greater resilience in the east of Scotland, and passengers will see some improvements as a result of that. However, the wider improvements in the east of Scotland will not be realised until we have the implementation of the additional high-speed trains into the network and the wider introduction of the New Attachee 385 trains, which will allow for additional diesel rolling stock to be moved to the east of the country. That will then be affected by the timetable change in December of this year, which should produce significant benefits to the east of Scotland. However, notwithstanding that, in the short term, ScotRail is taking forward actions that they intend to focus on making sure that there are deliver improvements in the east of Scotland. I will make sure that, through my officials and my engagement with them, we maintain their focus on that very issue. Just to let the minister and members know that there are eight members who wish to ask supplementaries on this, all from different parts of the country, I imagine. We will try to get through at least as many as we can. Christine Grahame, to be followed by James Kelly. Thank you, Presiding Officer. Can I ask the cabinet secretary to meet more of it, Alec Hines, to raise the issue of cancellations on Easter Sunday on the borders railway when 15 scheduled train journeys were cancelled? For my constituents, another raw deal and no doubt losing potential tourists to Newton Grange mining museum, Melrose and its abbey and even Abbotsford. Back to that last chance saloon, forget last orders. How close is ScotRail now to the exit door of the last chance saloon? As I made very clear at the Wreck Committee, if there is one aspect of the remedial plan that is not implemented and fulfilled by ScotRail Abelio, it is in default of the franchise agreement, which can result in the franchise being removed from it. In relation to the particular cancellations that the member made reference to, Mr Fraser, they are of an unacceptable level. The reasons that have been given to me by ScotRail for that are a combination of staff leave and staff not taking up rest day working, which is why it is important that they recruit additional drivers and additional conductors, which is two of the key commitments that are set out in the remedial plan. However, that will take time to be delivered, but it is important that they continue to make progress in looking to address those issues as quickly as possible in order to ensure that the type of experience that Christine Grahame's constituents had on Easter Sunday are not experienced again in the future. With 27,000 cancellations in the last year, ScotRail service has become a shambles in a national embarrassment.  Meanwhile, the Government and the Cabinet Secretary sit on their hands. Is it not time that the Cabinet Secretary stepped in, stripped a belly off the contract and put in place a publicly-owned rail service that puts passengers first? First of all, I am surprised at Mr Kelly's question, because, as Mr Kelly will be aware, we do not have the power to set up a public sector rail service here in Scotland. It is a matter that is reserved to the UK Government. I hope that we now have the support of the Labour Party in Scotland to see changes to the railway act, which would allow us to look at a whole range of models on how we could deliver our rail services here in Scotland, including the public sector option, which is one that the Labour Party believes is the main way in which to address those matters. However, I certainly hope that that is now an indication that we have support from the Labour Party to see the full devolution of railway powers to this Scottish Parliament to allow us to have that opportunity. In that position, we will certainly look at taking forward what we think is the best option for Scotland railways. Liz Smith will be followed by Colin Beattie. Could the cabinet secretary tell us exactly how many qualified train drivers are we short in ScotRail? What are we going to do in the short run to ensure that those trains are able to run properly? If the member gives consideration to the remedial plan that she was issued by ScotRail, she will set out in there that they are recruiting an extra 55 new drivers in order to address the shortfall that they have at the present moment. That is a piece of work that they are undertaking at the present time, and they are advertising and recruiting at the present time. Alongside that, they are training some of the drivers that they have at the present moment to be able to operate additional fleet. Those who are trained in a particular fleet are also being trained to operate other trains in order to provide greater resilience within their existing complement. Alongside the 55 drivers that they are recruiting for the whole of the network, with a specific focus on the east, they are also recruiting some 30 additional conductors that will be in place by July of this year. The funding commitment that they have made to deliver on that is funding that has been delivered through Abelio ScotRail directly to them. That is the figures that ScotRail believes that they need to address the existing shortfall and to give them the resilience that they require within the existing complement of staff that they have alongside the additional training programme that they have in place for their drivers and conductors. Colin Beattie, to be filled by Clare Baker. Can the cabinet secretary give an indication of what percentage of delays over the past year are attributable to the Tory Government's shambolic operation of Network Rail? Members will be aware of some significant challenges that we have had in the east of Scotland that have been due to infrastructure failures, particularly outside Haymarket. Some of which have been repeated, which I have raised with Network Rail, asking them to give me assurance that not only are they repairing those particular faults but that they are taking forward the necessary infrastructure investment that is necessary to minimise the risk of these types of problems occurring again in the future, because they have caused significant disruption to the network, particularly in the east of the country. Overall, in the course of the past 12 months, 65.5 per cent of all delays on our network are due to infrastructure failures. As I have said in the chamber, on a number of occasions and also at committee, it is critical that both parts of our rail network are operating to the best of their ability to deliver passenger services, such as Network Rail and the ScotRail franchise. That is why it is important that we have overall control of both aspects of the rail system in Scotland to ensure that we are running it to the effect that reflects the needs of the people of Scotland. Clare Baker, to be followed by Alexander Stewart. I am sure that the cabinet secretary can now be in no doubt over the appalling service that five commuters are experiencing. The most fifers are being promised by ScotRail is that peak time services will return to normal, just normal, not be improved as a Christmas present. The franchise cannot continue, as people are persistently late for work. The economic impact on fifers cannot be undervalued. Does the cabinet secretary recognise that and will he reconsider the need for a fair cut for five services to compensate for this terrible service? I recognise that. That is the very reason why we issued a remedial notice to ScotRail because of the impact on services in the fifery area. That is why, within the remedial notice, they set out the range of actions that will be taken in order to address the very issues that are affecting Clare Baker's constituents. Alexander Stewart, to be followed by Stewart Stevenson. Cabinet Secretary, there is still real misery for commuters in my region of Mid Scotland Fife. They do not call it the rush hour going to work and coming home. They call it the crush hour because individuals are crammed into trains that are delayed or cancelled and only a number of carriages take place. What reassurances can I give to my constitution that this situation is going to improve because they see nothing but it getting worse and worse on a weekly basis? One of the things that we have been pressing ScotRail to ensure is that they are utilising all of the rolling stock that they have available to them, particularly in the east of Scotland. The biggest impact in being able to deliver the additional rolling stock that is needed for the east of Scotland is the late delivery of the high-speed trains, such as the HSTs from Labtech, and the late delivery of the 385s from Hitachi, which have their impact on being able to move the diesel rolling stock over to the east of the country. Once that is in place, that will free up that rolling stock to allow it to be moved in as well. As it stands at the present moment, there are approximately 11 high-speed trains in place in Scotland at the present moment. With the utilisation of those over the coming months, that will free up the diesel rolling stock that can then be moved into the Fife area, which will provide additional carriages for passengers in that area. To deal with the overcrowding problems that are being experienced, alongside the electrification of the shots that line into Glasgow, that will freeze up the diesel rolling stock, because we can now use 385 electric trains on that particular route. Once we have the full complement of those from Hitachi, which they now say will be delivered by the summer of August of this year, that will free up diesel rolling stock in that area, which again can be moved into the east of Scotland, into the borders and into Fife to provide the additional rolling stock that is necessary there. There has been a cascade of rolling stock that will take place, but it has been delayed and it is having an impact on passengers' experience at present time in the very way that the member rightly highlights, but that is in part due to the delays in some of the new rolling stock coming in to allow the freeing up of the diesel rolling stock to move to the east of the country. Stewart Stevenson, to be followed by Jackie Baillie. To what extent does the cabinet secretary hold angel trains and their contract with Wabtec accountable for the utterly desperately bad delivery of the HSTs to delivered in December when 17 were contracted to be refurbished by that date? As I have mentioned, there is absolutely no doubt that the late delivery of the HSTs had a significant impact in the ability of ScotRail to move some of its other rolling stock, the 170s in particular, into the east of Scotland, which is having a very adverse impact on passenger experiences in those areas. I have discussed this matter with the chair of and chief executive of angel trains. I have also discussed the matter with the global president in the states of Wabtec about the delay, which is unacceptable. It has provided me with assurances that it is doing everything that it can to try to move the issue forward. It is transferring some of the work up to Kilmarnock in order to try to speed up some of the refurbishment work that is due to be undertaken on the high-speed trains, but there is no doubt that that is having an impact, as is the late delivery of the HSTs, a matter that I raised when I discussed the matter with the global head of Hitachi in Japan, making it very clear that it is unacceptable that we are experiencing on-going delays in delivery of the brand-new rolling stock. Those are all having an impact on passengers' experience of what is a very significant level of investment that is going into a railways in Scotland. I want to see that realised sooner rather than later, and those companies are all a part to play in making sure that they deliver those trains as quickly as possible so that passengers get the benefit of that additional investment that they are making in Scotland's railways. Jackie Baillie, to be followed by Alex Cole-Hamilton. Cabinet Secretary, the problem is not confined to the east of Scotland. Performance in parts of the west of Scotland are at a record low. In March, trains arriving on time in Dumbarton 56 per cent, Ballach 48 per cent and Helensborough 42 per cent. For the avoidance of doubt, there is nothing to do with training of staff or indeed new rolling stock. When the trains do show up, three carriages instead of six are short-formed. Can the cabinet secretary tell me when we will see a marked improvement in the Helensborough and Ballach lines? On a specific issue, I will ask ScotRail to provide a direct answer to the improvements that will be made on that line. I can say to the member that she will be aware that the Donovan review set out a range of measures that had to be implemented to improve, particularly services on the west of Scotland. In some routes, we have saw marked improvements as a result, but in others we have not saw the full realisation of those. The reason for that is that all the recommendations from the Donovan review have not been implemented as yet. That has been monitored by the Office of the Road and Rail, which has said that ScotRail is making good progress with it, but there is more that still has to be done. I would expect to see the infrastructure improvements and the other timetable improvements that were recommended to start to deliver better and more reliable services in areas of the west of Scotland. As I said, on a very specific line that the member made, I will ask ScotRail to provide a member with a detailed response to that matter. The cabinet secretary and I have discussed many times the situation at Dalmenny station in my constituency, which is quite possibly the worst-effected by the ScotRail crisis. Just after Christmas, part of the problem of train cancellations was mitigated by putting in additional stop orders on the Aberdeen service coming south at rush hour times. However, I have challenged ScotRail several times to put that same stop order on Aberdeen bound trains leaving Waverly in the evening, but that is still not forthcoming. What pressure can the cabinet secretary apply to ScotRail to see that advanced stop order applied? In meeting with Alex Hynes tomorrow, I will ask him to address this very issue and to respond to the member specifically on the point that he has raised. I thank the cabinet secretary and members for getting through 10 more questions.


anybody that you're following, anybody that you think you have respect for, you have respect for, that you trust their opinion, if they haven't defended Julian Assange, they are garbage. If they're involved in politics and economics and politicians or whatever, right? A newscaster, journalist, right?  And if you want to know where they stand, force them, force them to tell you their opinion, right? If they're on any platform, Parlor, Twitter, Gab, Mines, L.O., VK, YouTube, Bichute, Odyssey, if they're on any platform and you don't know where they stand on Julian Assange, ask them, where do they stand on Julian Assange? Where do they stand on truth? Where do they stand on war crimes? Because their stance on Julian Assange will reveal everything you need to know about them. If they think war criminals should be prosecuted, if they think there's justice, there's morality, right?  If they're not smart enough to realize what the Julian Assange case is about, why do you support them and why do they have power, right? Do they have power because these oligarchs know they're just puppets, right? Stop supporting puppets, okay? If we have a responsibility to wake the F up, wake up, wake up.


Good afternoon, everyone. My name is Chris Van Tijn, Chief Technologist for the West Region at Red Hat, and I've been with Red Hat for about 12 years. I work with strategic partners and customers up and down the coast who are adopting Red Hat's emerging technologies. Red Hat has certainly moved well beyond Linux into middleware, virtualization, container and cloud management. And one of the hot topics is certainly about enabling companies to deliver capabilities quicker to the marketplace. And ultimately that discussion usually leads to a talk about DevOps and enabling technologies such as containers, container management. And with that transformation, there's a lot of implications around security, so we'll touch on some of those today in the talk. So first off, about 20 years ago or so, Andy Grove talked about how only the paranoid survive. You know, it's not about security, but it's about inflection points in the market when there's huge disruption, huge amounts of change, a company has to make a decision do they adapt with the potential to thrive or do they stay as is and fall by the wayside potentially. And as we've seen in the marketplace, you know, software is a disruption right now in many different industries, whether it's retail, finance, media or transportation, and software is having a huge impact. And putting a lot of pressure on IT to not become the bottleneck and keep pace. And so there's a movement towards DevOps in terms of how applications are developed in a movement towards containers in terms of enabling applications to easily move from dev tests into production. And DevOps is all about, you know, a cultural shift, bringing together siloed organizations typically dev test and operations and bring them together. Also in terms of process, implementing continuous integration, continuous delivery, pipeline. And then also the enabling technology with CICD, typically open source solutions are being leveraged to build out this automation software factory to deliver software rapidly for the business and enable innovation. You know, in terms of security though, that's a missing piece on that slide and it's an important piece. Typically when I met with customers early in my early days at Red Hat, they would talk about security, they would say, well, we really don't patch our servers because they're all behind the firewall, right, we hide behind that. And if you've read the news in the last several years, you've seen a lot of brand names being compromised in terms of security. These folks represent, in 2014, over a billion data records were breached from a security compromise. And if you look at the top reasons for security issues, you know, a third of its employees not taking proper security measures, another third on outside breaches, and also unpatched servers as well. So a lot of reasons around these security compromises, but security needs to be taken seriously. And that's why, you know, DevOps needs to include security as well. There's a talk around DevSecOps as well. And extending security in your culture and the people and to the processes as well as into the tooling. So end-to-end security in the DevOps environment is very critical. And here are some examples, does anybody recognize what this is a photo of, right? This is the latest Intel fab that's being built in Arizona. And the reason I show this is because when I started my career at Intel about 20 years ago, they were going through the pinion bug. If you recall, the pinion bug was a floating point unit air in the silicon, and it resulted in a lot of negative PR at Intel. It also resulted in almost a half a billion dollar write-off because they had to do a recall of the chips, right? And so this was an inflection point for Intel, and they had to adapt and make a decision. Do they, how can they learn from this and how can they get better as a company? And so they invested significant dollars in terms of continuous integration and validation of their chip designs, not in the fab but in the software factory that frontended this fab. So as chip designers came up with a new design, their component of the overall chip, they would submit it to this automation cluster, which actually would schedule a job and validate that test or that design with an automated test. Today they have tens of thousands of systems running these automated batch jobs to validate chips. So continuous integration, a key component. Also here's another factory, does anybody recognize what this is a photo of? That's correct, that's the Tesla automobile factory, and the reason I show that is not only software automating the pipeline and producing these vehicles, but software is having a huge transformation on these vehicles after delivery to the owner. For the first time you can go to an automobile lot, buy a car knowing that car will get better 6, 12, 18 months down the road. They're able to send software updates over the wire to the vehicle, improving zero to 60 time, battery efficiency, or the applications in the center console. How many have heard about a vehicle recall really in the news for an automobile, right? Seems like every week. What if it was a security issue to an autonomous driving vehicle? You would want a way to deliver a security update quickly to that vehicle. And so continuous delivery capability is a key component of this new software factory that you need to build out. So CI and CD. In the flip side of that, I own a Ford Fusion and just got a recall notice because the network that the onboard cell modem uses is being decommissioned after a certain point. So they will no longer be able to push all of those updates. So you end up shifting to a certain extent where the safety exposure exists into upstream providers in the land. In terms of DevSecOps, the CI-CD pipeline, there are a lot of ways you can go about it in terms of writing scripts, in terms of do it yourself, but what about building that factory out of the box and that's with a container application platform? And that's what Kubernetes is all about, is automating this software factory enabling you to have continuous integration and continuous delivery, not only of your software applications but bug fixes and security updates too, and enabling you to deliver these updates in a matter of minutes versus hours or weeks or months that a typical enterprise takes to deliver new capabilities. And so containers are a big part in terms of security because they enable the developer to package in their application with all its immediate dependencies and abstract itself from the underlying host operating system. And this is important because this also allows the operations in the security team to still apply compliance and security rules without encumbering the developer from moving quickly with their application. And so packaging your application once and then being able to deploy it as is in your dev test and your production environment is a key part of containers. And you take a look at Linux containers, the basic flow is to build, ship and run. From a developer perspective, you define a build file with the different components you want to go into the container, pulls it from a trusted repository and then out comes a artifact, a container image. You can then share that container image via a registry, whether it's private or public, and then you can apply that artifact to your test environment exactly as it is or to your production across physical, virtual, private or public cloud infrastructure. And when it comes to this software factory, there are a lot of security aspects in terms of securing and hardening your container environment from images all the way down to the hosts, to network, storage, API monitoring and federated clusters. In this talk, I'm going to focus on that top level and talk about securing container images, registry builds, CICD and the container hosts. So let's start out with the container image security. So first off, as a best practice when it comes to containers and you're building out your applications, you want to make sure that you're architecting them in the best way in terms of security is, first off, you want to separate ideally your code from your configuration and from your data. This allows you to have the ability to deploy these applications without hard coding them with your security configuration or your security data as well. And so you want to make sure that you actually separate these out as best as possible. Now when it comes to the actual container, when you take a look at the container, whether it's a C application, a Java, a Node.js or a PHP application, you want to take a look at what's going into these containers. So when you build that container, for instance, if you build the Java application, it'll pull in the JRE, BASH and G-Lib C. Well, when you pull down that image from your registry, it may have some security issues. In this regards, the JRE, that little triangle has a 66 in it. That means that there's been 66 security notifications for the JRE since rel7.0 was released. So what that means is not only do I need to worry about what's in the container at the time I pull it down into my environment, but I also want to make sure keeping a regular process to scan those image is and know what new security issues are popping up because security errata is released all the time. And so you want to make sure that you have a processing in place to actually scan those. Also as you're deploying these container images out into your environment, you want to make sure that these are trusted images as well. So you want to sign these images and then check that signature as well. So before you run it in your container environment, you want to make sure that it's an authentic image and that it's not being compromised. Also in terms of container registry security, I took a red hat scan the Docker hub at one point in time and found that 64 percent of the images on the public hub actually have a critical or medium or high priority or medium priority security issue. So these are things like shell shock, heart bleed, poodle. And so if your developers are pulling these into the environment, you're exposing yourself to a variety of security issues. So you need to work together with operations and have an overall security scanning process. A good best practice is actually to set up your own private registry and the enterprise. This allows you to control which content is being made available within your enterprise. You also can keep track of the usage of these components as well, inversion control, et cetera, within your enterprise containing custom-made images as well as third party. How do you integrate this with your continuous integration process? So if you look at the typical CI CD process in a containerized-based environment, it looks something like this.  But in the container world, these aren't physical environments, they're actually virtual. So your DEV environment is a mirror of production and likewise your UAT is a mirror of production as well and containers allow you to set up these virtual environments using your container management platform. But from a flow perspective, typically your developer checks into a source code management, maybe GitHub, and then that triggers a build of the container image. Well the container image is built by pulling base images down here and then pulling it and the build image will actually build out the target container image, putting the application along with the application runtime and the dependencies that it needs. And then you'll store that resulting artifact into the image repository. Now how do you go about managing security of this container image? The container image may have multiple layers, you may have the base image which is the core operating system, maybe it's REL7, and then you have your middleware layer, maybe it's a Tomcat application server, and then the third component would be your actual application. So how do you go from the separation of responsibilities today to a container where it's all put together in that container and still have ownership and delegation for security tracking and security updates, etc. And so with the container build file, you can still have the OS owner specify the operating system component and then the middleware would own that in terms of the application layer and then the application coder would actually own the application logic that sits on top of that platform. The difference is, instead of using a kickstart file, a tarball, and a jar file, we're now all talking in the same language because we're using the Linux container build file to specify as the blueprint. So this kind of normalizes things and helps bring together these cross-functional teams to be collaborating. Also with these container models, you can also trigger rebuilds on these layers. And so you could actually watch any one of these layers, and if there's a dependency downstream, you could trigger an automated rebuild. So maybe there's a security issue in the core build. You would want to watch, is there an updated core image upstream in your registry, and if there is, automatically trigger a rebuild of any application that depends on that particular base image. And then you could actually take it to a next level, is then go automatically deploy this into production after it goes through testing with the updated version and security fix. And so integrating security scans into your continuous integration pipeline is an important step. So you may want to add an actual step. This is the Jenkins build CI CD pipeline. So in build one, build two, build three, you can see as it moves from commit code review unit tests, we've added a phase for security. And what this does is just run an automated scanning tool, which we'll talk about in a minute, to check the container image that was built to make sure it doesn't have any known security vulnerabilities, or it makes sure it conforms to the security policy as well. And so how would you go about doing that, to scam for compliance and vulnerability audits? You could use an upstream tool such as OpenScap, there are other solutions out there, Black Duck Software has one, Anchor is a startup that has a scanner as well. So a lot of tools that are out there, the important thing is that you're integrating some sort of automation into your CI pipeline, so you're scanning for container image issues. And so in the case of OpenScap, this upstream utility, it comes with a security guide for the target operating system, which has a list of security policies. And also you have the ARATA in terms of the CCEs, which tells you a specific checklist that the government has issued as far as guidelines for hardening your particular operating system. This may be minimum password length, it may be making sure that legacy services are disabled like TFTP or something like that. And then also the government issues CVEs for your target operating system, which are security ARATA, notifying that particular components in that operating system may have a security issue, what it is, and how to address it. And so that's the content portion of OpenScap. There's also a set of tooling available, command line tools, daemons, GUI tools to actually build the checklist, build the policies, and then also run the scanning and generate reports as well, which we'll go into. And so that's the third component, is the reporting aspect. So some of the use cases for OpenScap are scanning for compliance, right? So our password quality requirements set are obsolete services enabled, such as Talnet, is OpenSSH properly configured, is slash tip, temp on a sub-partition. And so to use OpenScap, you can use the command line utility, and this could be integrated with your CI flow. When you run it, it will give you a list of whether it's passed or failed on the target, whether it's a host operating system, a virtual machine, or a container.  You can then drill down and see the overall scoring. So in this case, there was 34 checks that passed and 33 that failed, three with high priority. And then I can actually drill down, and I can see all the different checks that either passed or failed, and I can see what the check was all about. And then I could actually drill down into that check. So in this case, I'm looking at the minimum password length, and I can see that it failed so it wasn't set properly in the image. But even more importantly, there's a remediation script to rectify this issue on the target image. Another use case is to scan for known vulnerabilities. So this is checking for known security issues, what RPMs need updating, what's the criticality, what's the vulnerability, and what CVEs haven't been applied yet. And so likewise, you can run a command line scan, and it will go through all the known security vulnerabilities and see if that target has any positives. And so after that, you can go into the HTML report and see a summary of the scan. And then you can see a list of each individual failure and see what the actual issue is. And then you could actually update your system as well. In terms of containers specifically, it allows you to see is the Docker image compliant or is the Docker container compliant. So this is offline or online, the container at rest, or actually running on a particular host system. And so there's some scan commands you can actually run and see if an offline image has a known vulnerability or a security issue against your policy. And then likewise, if they're actually running on a target system, you could use this to see in real time if they have any issues as well. And so that's the open scap. There's also a GUI workbench for a variety of operating systems where you can define your policy and your checklist so that you can either remove or add particular checks depending on what your particular security policy is at your enterprise. There's also an add-on. So if you're building target Linux systems, you can, with Anaconda, you can actually add this on. For instance, if you did a default install, actually only got a 64% score versus if you ran this test, it basically got 100% almost in terms of being compliant. Also we talked about continuous integration. What about continuous delivery with containers? So here we're focusing more on the right side, getting the new capability, moving it from source code into dev, into UAT, into production. So how do I do that in a consistent, reliable, automated manner with containers? And how does that look? Well, typically, a typical CICD with a non-containerized application, you move the jar file from development into tests, into production, and then with a container image, with that same application, you're actually moving the whole image file. So you build it once and then deploy everywhere. So I build it in development, and then I take that exact image that the developers built and then move it into QA, staging, and then production. So QA isn't rebuilding and not reconfiguring it. They're not rebuilding or reconfiguring in production either. And so if you're using something like Jenkins and Kubernetes, you can actually leverage the built-in capabilities to do deployments. And there are a few different deployment strategies that are built in out of the box with Kubernetes. One is a rolling update deployment. So this is when you have a cluster of your application, version one, version one, and version one on three different hosts, multiple instances of that container, and you want to deploy the new version 1.2. In tests, I've created a virtual instance of my test environment and running those tests. And then within Kubernetes, I don't have to script this. I can just issue a command and it'll actually do a rolling update of my production environment. So think about this security patch. I need to quickly get it out there and roll that update across my cluster without bringing it down. And so I could do that by automatically updating my load balancer as each host is updated with the new version. So that's a rolling update. Also another deployment strategy is the blue-green. This is where instead of doing a rolling update of in place, you actually have one virtual instance of this cluster running version one, and a security issue comes out and you want to roll that out quickly. Well, instead of updating the existing environment, you just create this whole new virtual environment for this new version with the updated security patch. And so after the security patch goes through dev, test, it's now coming into production. So here it's being tested. And so Kubernetes created this whole cluster for version 1.2, and then the old cluster is still virtually there, so if there was an issue, I could actually roll back to that cluster just by updating the software load balancer. So those are blue-green testing and rolling updates for deployment strategies in your container farm to deploy those security patches quickly. Next, let's talk about the container runtime security. So this is a key component. You have these images that have been scanned and ready for production, and you want to make sure that they're running in a secure environment.  First off, try not to run this container image as root. There is a security issue and within the container that's running as root, it can get access to the host, then it's also root, and then it could get into other containers as well. Also you want to limit SSH access to your container images. Try to access anything through an API. If you need logs, if you need any information from these containers, try to have a API access, so SSH lists. Also you want to use namespaces as well to set up nice isolation and separation. You want to define resource quotas, so you don't have the noisy neighbor consuming resources whether it's storage, network, or CPU or memory. And then also you want to enable logging. So Kubernetes has a way to actually turn on logging and aggregate that logging so you can put it into Splunk or whatever viewing system you'd like to analyze that. And then that will help you identify security issues, it can be a proactive notification. Also you want to have a best practice around applying security orata not just to the container images but also the container host in your cluster. So it's very important that you have a standard procedure for that as well. And then also apply security contacts and set comp filters so Kubernetes out of the box allows you to apply these capabilities so that you limit what a container can do on the host in terms of kernel access. And so that will provide an extra level of security for you and ensure that if there are security issues within the container image it will help minimize the authority and the access that they have in that compromise. So that will be limiting those breaches. So in summary in terms of securing your container environment, you know we talked about container scanning, really a critical thing to implement and integrate into your CICD process. Above and beyond that there are different aspects in Kubernetes that allow you to have security control around network isolation with network namespaces. Also storage with the ability to mount both local and shared storage, applying quotas and access controls to that storage so that containers can only access what they're authorized to from a storage perspective as very important as you move your brownfield applications into a container environment. So as we go to an API world where everything has an API, you know how are we controlling access to these APIs? How are we limiting the volume of requests from a quality of service perspective? So there's some capabilities around that, you know centralized monitoring and logging to help with your security proactiveness that you can get visibility into potential issues based on trends. And then also, you know, leveraging cluster federation to isolate applications from one another and even enabling you to run one cluster, a part of a cluster in a public cloud and maybe another cluster in the private cloud and being able to have an aggregated central API around those multiple clusters. So this is securing your container environment and that's all I had for today. And I want to thank you for attending today's session. That's my email address. Feel free to send any emails if you have any questions. I'm also on LinkedIn under Chris Vantyne and I'll be around after the session if you'd like to ask any questions. So thank you so much.


Hey guys it's Julia and welcome back to the reading vlog. So today is June 9th and I just went to update you guys on my reading so I just uploaded a little reading vlog that was kind of like sporadic clips that I've gotten so hopefully I'll actually stick to this one and make sure I do it more consistently and update you guys more. But for a reading update, I am currently listening to an audiobook and I'm listening to the audiobook of Listen to Your Heart by Casey West. This is like a cute little YA summer romance and it's about like a this school who has like and this girl's like in a podcast class and she her podcast is like an advice podcast and then there's some like little romances in there and it's very cute. She's like on a lake or like her family works for like on a thing. I don't even know how to explain it yeah like her family works on a lake kind of thing. I don't know something like that but yes so far it's super good. I have about two and a half hours left so I've listened to a lot of that today but yeah I'm really enjoying it. It's super cute and I think it's like perfect what I'm in the mood for right now. So it is Tuesday. I actually ended up finishing that book yesterday. I started it and finished it yesterday so happy about that. Oh look the books making it unreflective. So I finished Listen to Your Heart by Casey West. I listened to the audiobook of this one. I ended up really liking it. It's super cute.  There's a lake like it's a perfect little summary read. I really enjoyed this. I read another case US this month but I ended up liking this one more. I think I'm giving it around like at 3.75. I still have to write my Good Reaves review because I made notes and everything so I have to do that but this was so cute. I really enjoyed it and the audiobook was pretty good as well and like it was good enough that I ended up finishing it in a day which is kind of weird for me especially with audiobooks because I usually don't binge audiobooks. Not because I don't want to it's just because I had to get bored or not not get bored. I don't know. Okay but yeah so today I'm gonna be out all day so I don't know what I'm gonna read. We will figure it out. There's so many things I could read. By the way I've re-organized my shelves a while ago so I ended up putting all my poetry and manga and graphic novels on one shelf and like my king swap I swapped it and I have my little like version suicide shrine over here it's adorable yes um so I did that Stephen King these are all organized and whatever talk about that later if you care but then I have this so this is a problem because this does not fit over there clearly so I'm like what do I do with it so yeah and I'm still buying books like I just bought the kiss quotient the other day so I'm like yikes so I I don't know I read this recently too this was um this was pretty good actually it was it's written by a booktuber casebook date I quite liked that one she sent it to me um yeah but this was like a phone case that I got um yeah I don't know cool I need to find something to read we'll figure it out and I'll update you later so I'm like crouching trying to get in frame but it is about 5 p.m. now and I started a book when I was out I didn't make too much progress but I'm happy with the progress I made so I'm reading escaping from Houdini I finally was like come on Julie you got to read it because I want to read it and I'm so excited like I'm so excited about it that I wasn't reading it because I was so excited and trying to like stall so like I just started it today and I'm on page 72 so yes I'm very excited about this one so far I'm really liking it it's giving me out of the christie vibes for some reason um but yes this is the third book of the stock and jack the ripper series yes I'm enjoying it so far I'm kind of like not taking my time but like I'm not in like a rush to finish it um I also got a few things in the mail so I have a book depository order each habit unboxing this is for june so super excited about this we'll open these two the book depository one they have it I don't I don't I don't know I avoid other people's unboxings till I get my own obviously plus I actually don't watch a lot of unboxings unless it's like joint unboxings anyways you don't care um this is this it only happens in the movies by hollyborn this uh if you don't know she wrote the spencer club trilogy and this is one of her other books it's I don't know bad voice turned good kisses in the rain climate only happens in the movies when andrew meets harry it's sort of a truly cinematic romance or is it um knows that he has every movie cliche rolled into one but she still just slipped him into her heart um I've enjoyed her hollyborn's other stuff and I also bought this for my friend Kayla for her birthday so I was hoping to like do a buddy read with her something like that so I got that um did it come with a bookmark oh my god it did yes wait what oh this is so cute who's your book bestie it has on to my book but this is so cute okay that makes me so happy so we so this is what we got so first up we got the two cards oh shit I already know what it is I have that book I have an arc oh well girl try it I'll probably give you that to someone maybe because I don't need it let's see this is no from the author as usual got a note from the author I love the glare got a note from the author and we have an info card that has all the boxes pics as well as our donation of the month that is contributed reading on the move with gimbal this like keeps your page open I love one of these stupid little like not stupid I love these little gadgets that they put in like they're so cute and addicting and like I always end up using them oddly enough um also we got these little handy bookmarks yeah see I love I love their goodies so much um we also got puffy stickers of little books with faces on them that's adorable um next is a short story called wings a forest um when maya follows sammy into the forest it surrounds their houses um the same the lastly she expects to sell upon is a veil of fairies cool cool cool cool mark I love their bookmarks actually one of their bookmarks I'm using in my current read I'm using one of their bookmarks I love their bookmarks I was going to be devastated there wasn't one in here so this is the bookmark and then have the quote which this one says if you truly love a book you should sleep with it write in it read aloud from it and fill its pages with muffy muffin crumbs and fattenment so this is looking side for my annotation so it obviously comes with an annotated book like all of page habits stuff does um so look for my annotations inside and it's the author's little initial there and it's filled with the annotation in it by the author so this is by Megan Bannon I have an art copy of this I got it at an event so like I didn't request it so I didn't like have to read it I was going to read it but then like I just haven't gotten around to it yet and it's um like it's like a historical fantasy if I remember correctly um three impossible riddles one three impossible riddles one dangerous secret and I am a page habit ambassador you don't know so if you use my code I'll have all the info down below but if you use that you can get some discounts and stuff like that so make sure to check that out I do quite enjoy page habits boxes and they have different genres so this is this was the YA box but they also have like romance mystery sci-fi and thrillers so yeah super exciting make sure to check that out if you're interested but yes that was my unboxing this definitely boosted my mood a bit because if you can't tell by this I'm not feeling that great but this I wanted to open this stuff for you guys so yeah I'll talk to you guys probably tomorrow the reading update hey guys so it has been a day I did not update you guys yesterday but I didn't read much I only ended up reading about there we go about 35 pages escaping from Houdini so what an update other than reading I filmed a ton of videos which I'm super happy with so yeah for being productive um I'm super excited about them they're importing right now I'm super excited to edit those and yes I'm so happy that I got that done um because I need to get more videos out to you guys but now it's to clean up the huge mess that filming made and that doing makeup full face made exhibit a is this so yeah yeah I just thought I'd update you guys hello this is the worst thing I've ever seen this is not any better hey guys so it is Saturday shit I don't remember the last time I updated but I haven't made any progress on escaping from Houdini yay I haven't made any progress great uh basically I'm not in a huge rush because I am I am enjoying it and I'm about like a hundred and a bit pages in but it's fine yesterday I was out doing social things all day and some work yesterday and then by work I don't by work I mean like work that I gotta do like I don't have technically a job but I mean work that I gotta do um um yesterday I got home super late like last night I got home super late so today I filmed a bit I got two videos done I just got like a really exciting business email so I'm like kind of freaking out about that I'm so excited anyways I just want to update you guys to say like hey howdy like I'm alive not much reading has happened um today I have a concert and it's a festival and three days grace is gonna be there and I'm so excited so that's what I'm gonna be doing all day so yeah I'm super excited about that I'll probably bring the book with me like my book with me in the car but like I'm so excited and I'm going with my friend it's gonna be super fun but right now I'm gonna probably edit a video put it up because like I'm in d-pop shop up so I want to get my unhaul up as well so yeah and I'll see you guys super soon bye hi guys so it is the next day I'm actually just going to be ending this vlog here I didn't do much more reading of escaping from padini but I'm hoping to read a little bit more tonight and I just finished editing a video so I'm gonna get that up not tonight because I uploaded a video today but I'm going to be getting that up in a few days um just getting it scheduled and as of all I'm gonna start editing this vlog so yeah I hope you guys enjoyed it let me know down below comment a flower some flower or comment flower if you stayed till the end um I hope you guys liked it I hope you guys are excited for more vlogs do let me know because I want to know yeah I think you guys like them from other feedback you guys seem to love them so let's hope you still do um but yes I'll talk to you guys super soon thank you so so much for watching and all my social medias down below and all that jazz I'll see you all super soon bye


In this part, I would like to give you a short introduction about security on MCU. Let's start with the definition of security, and you can find it in Wikipedia. Security is a degree of resistance to all protection from harm. It applies to any vulnerable and valuable assets such as a person, dwelling, community, nation, and organization. What is important in this definition is the fact it's a degree of resistance. It can be an absolute protection. Think about this. And then we've got this word asset. Let's try to define what is an asset. In fact, an asset is what you want to protect, but you want to protect it because it's valuable for you. But it could be whatever is valuable for you. So it could be an information. It could be a capability. It could be a feature. It could be a technical resources. In the case of the MCU, it could be some software resources, some access to the device, on such kind of things. So in fact, an asset is many things, and you have to identify this asset inside your product and the ecosystem associated to your product. In fact, to protect your asset, depending on this asset, you will protect different properties. We've got the CIA, the confidentiality, the integrity, and the availability. Confidentiality, that means the information is not made available to unauthorized individual entities and process. That means you ensure only people that have access to this asset or to the information how to get this access. Integrity, you ensure your asset has not been modified in any manner. Availability, ensure when you need information, this information is available. Leveraging ST's ecosystem to secure your STM32 application. In fact, today, IoT enables intelligent service everywhere.  The backdrop of this huge interconnection level is that you've got some threat at each level. I mean, you can have threat at service and network level, at device level. You can have some theft of confidentiality or identity on the creation of counterfeit device or services. And to build a security, I propose to go through three main steps. The first one is threat analysis. That means on your system, you need to define or to analyze what are the assets, what you want to protect, what are the potential threats of vulnerabilities, and how you will find some contaminations. At a security, at a system level, sorry, you have also to ensure all the elements inside your network or system are well secure. And the last step is thinking about how I build a security from the G1 to the end of life of your product. First step, analyze your system. Let's start with some definition. First, the asset. The asset is what you want to protect. It could be your device, it could be your code, it could be your brand, it could be a location, whatever is valuable for you. Then the threat. The threat is what we need to protect against. In fact, the threat could damage your assets. Then the vulnerability. In fact, vulnerability is a weakness in your system. That means a threat could exploit a vulnerability to damage your assets. And finally, the risk. And the risk is the intersection between your asset, your threat, and your vulnerabilities. And building a strong security is to minimize this risk. So now we have the words. We've got the asset, what we want to protect, and we've got the threat that could exploit some vulnerability to damage your asset. And the intersection of all those are the risks. Let's define the process to do the threat analysis. First thing to do is to identify the assets in your system. That means what you want to protect. Then you need to identify the threat. That means whatever could threaten your system. It could be a remote attacker. We could imagine somebody would try to break into a room. I don't know, or someone would try to open your device. You have to think about all the control threats. Then you have to identify the vulnerabilities. I will just take the example with an IoT device with a hard node. I need to keep my debug port open for any reason. Is it a real weakness? An attacker could have a physical access to my device, connect with the debug link, and get some confidential information. This could be potentially one vulnerability. And the last point, maybe the more complicated one, we need to find some contaminations. We know that a threat could damage my asset thanks to its vulnerability. Which contaminations I could put into place to ensure my asset is preserved. Now, you should have in mind what is the threat analysis and how to do it. But keep in mind that during the lifecycle of your project, potentially we will discover new vulnerabilities, so you will have to do the reassess of all this process. Now, let's try to understand how we will build our secure solution from the design to the disposal. At the beginning of the product lifecycle, there is a definition of your product and also the design. At this step, you should do first the threat analysis. So now at the customer side, we need to identify the asset, the threat, and looking for vulnerability and contaminations. For the methodology, I already give you the input, but you can find more information on this link. If you find this too theoretical, I would recommend you to have a look in this example done by Harm for the PSA Threat Model Analysis. There is three IoT systems who are fully analyzed and you can just have a look in this documentation. Quite easy to understand and it really shows you how to do this concretely. Next step is the design and the development of your product. And here again, we will try to identify how to to determine properly to mitigate any threat. Now, the project team should find the hardware solution or software library to help him building a secure solution. In fact, ST has a wide product portfolio and strong security ecosystem. Depending on the selective device, we've got different mechanisms like secure boot, debug lock, MPU, some isolation with firewall, threat zone, dual core, and also the capability to interface with a secure element ST safe. This is for the hardware resources. We also provide you some software resources with some X-Cube CryptoLib, the SBSF, for example, the PSA-TFM on the Hellfire Specific, some fast rom or programation services, and secure firmware install. You can find many details about this in our site in the STM32 Trust. And also you can have a look in our security MOOC, which are also available on our site. So building the security with STM32 could be combined with the ST safe. STM32 brings many mechanisms like memory protection, readout protection, write protection, put some portion in flashing execute only with PCrop, some hardware accelerator for the crypto, and some isolation mechanism like memory health protect, threat zone, and such on. We also provide you some software packages with the CryptoLib, the SFE, and the SBSFU. But the STM32 MCU is a general purpose device. That means if you got a cynical attack, someone tried to delaying something or you won't resist frankly speaking. If you need to resist such kind of attack, you can have the ST safe, which is a secure element. And this one guarantees an optimum security against silicone level attacks and board attacks also. So there is some specific congealment and there is some strong authentication. There is the capability of key storage, of code storage, and also there is some mechanism of key provisioning. So I would say adding a ST safe, you have a higher level of security if you need it. Now how to address the security during the manufacturing. In fact, the device owner often use a contract manufacturer to program the device. But in the same time, you want to protect its code from linking, and you also want to prevent some over production. To avoid any linking of your code, a mechanism would be to encrypt your firmware and ensure that it was decrypted inside the MCU at the first flash. For the over production, you should find a way to count the produced pieces in a trusted way. With an SSM for example. In fact, we proposed some solution for this. So it was a secure firmware installed mechanism. You can see here the different documentation and also you can go home. Our site will have details about this mechanism and how it preserves the confidentiality of the code and also to prevent the over production. And the last step of the product lifecycle is in the field and the hand of life. In this context, the device owner want to ensure about the authenticity of the firmware that is running on the device. And also we want to have the capability to communicate with it in a secure way and also to do some secure update if needed. To address this problematic, in fact, we need to implement a route of trust in your application to communicate of a secure and trusted channel and have some check firmware update authenticity and integrity. If you are a little bit familiar with security, it's what we often call a secure boot on a secure firmware update. We also propose some packages to address this problematic. The SBSFU with secure boot and secure firmware update packages. And on the hell far you've got the TFM, Trusted Firmware Quarkotics M, which rely on the HAM PSE initiative. Another point is to ensure that we have secure all the elements of the system of the network. To ensure your security in a global system, you have to ensure that there is security at each level. First in the IoT Server security. Okay, it's a little bit out of scope regarding MCU, but it's something that you have to take into account in your security analysis. Then at the gateway level, here you can use the MCU G4, HALF4, HALF5, F4F7, H7, MP1, one more, depending on your needs. For the security aspect, we still have those packages with secure boot, secure firmware update and the TFM on the HALF5. And finally that's on the node where the price and city of the device is important. Here we've got some G0, G4, HALF4, HALF5, WB and more. I'll let you have a look in our proposal. And we can also address the security stuff thanks to our software packages and the security IP embedded in the different MCU. And now to conclude this presentation. So now you should have in mind that security should be seen from the G1 of your project until the end of life of your product. The first step of your security definition should be the security analysis of your system. And I remind you of all the system, all the content part from the cloud until the getaway, until the on node. You have to identify the assets, the threat and the vulnerabilities. Thanks to this information, you can think about counter measurement and the strategy to address a good level of security. Then you can rely on ST security ecosystem. We've got all our MCU with different security mechanism and also the security packages that is delivered for you. Those one have been certified and guarantee a certain level of security. And if you need to be resistant to any advance attack at board or silicon level, adding a ST safe companionship to the MCU will address this requirement. The STM32 trust ecosystem combine knowledge, design tool and ready to use original ST software. This allow you to build a strong security into your product device. All the related resources are now in one place www.st.com. I hope you enjoy this presentation and thanks for your attention.