Välkomna, alla! Jag är glad att se så många folk här som vill möta och lära sig från Steve Denning, som vi har idag, som är en annorlunda för oss. I dag är vi i KRISP. Jag är en konsultant här i Stockholm och är fint att hitta Steve här. Det är ett möta-event som är organiserad av ädgade folk. Det är det nätverket som vi har för att förändra för att göra bättre organisationer och mer ädgade organisationer. Hur många har varit med och möta här i ädgade folk? Och hur många har du varit med i KRISP? Det är samma folk. Steve har just läst sin nya bok, H.O.A.G.L. Vi är väldigt glada att höra om sitt forskning och vad han har lärt och vad det är om. Och det är ett bra bok, jag har bara läst det. Jag är väldigt glada att höra mer om det. Vi har Mattias Holmgren här från KRISP och andra folk som modererar lite med Pia Mia, men också med andra folk. Välkomna de tre av dig. Vi börjar. Du har ditt eget. Du behöver det? Oh ja, sorry. Mattias, du måste komma och stanna här med mig. Vi ska göra det lite informalt. Vi har inte förberedat något. Vi har sagt att det blir mer bra om vi inte gör en form eller presentation, men vi gör en typ av en fråga- och anser-session där vi kanske börjar med att fråga några frågor, så vi kommer att fortsätta. Vi har en tal om året av Agile och ditt bok, och vad du har gjort, och vad du har känt. Du har träffat mycket, som jag förstår. Jag träffade dig i Indien. Ja, vi träffade i Indien. Vi träffade i New York. I New York? Var är du i Australia? Jag ser inte dig där. Nej, jag går nästa år. Nästa gång. Jag har träffat. Vad är de människa frågor som du får på ditt träffat? Vad har de tågat ditt människa? Varför har du tagit ditt bok? Ja, han har det. Och kanske kan jag börja med lite om den här historien som jag har tagit ditt bok och vad jag gör nu och vad de gör. I början var jag i Sydney, Australien, och jag gick upp där. Jag gick tillbaka innan jag behövde. Jag var där två veckor sen, och de frågade mig, vad är det som sker? De frågade mig om det. Men jag hörde några människor fråga mig om det. Det är inte färdigt att fråga mig om det. Jag jobbade som lawyer i Sydney. Jag gick till Oxford University i England och studerade lite mer. Jag gick till World Bank och började i ett internationellt organisation med dollars. Jag jobbade i World Poverty. Jag jobbade där för många år. I fack, jag är en stor, lägre, analytisk person. Båda organisationer älskar det. Jag gick tillbaka in i World Bank. I djurkors gick jag upp en strategisk förändring i World Bank. Folk gick tillbaka. Hur gjorde du det? Hur var det möjligt? World Bank är som världens mest förändring. Hur var det möjligt? Många än du är. Många än du är. Många än du är. Jag hade att confessa att jag skulle hålla på tillväxten. Det var det som som gick tillbaka. När jag gick till World Bank i 2000 gick jag tillbaka i 10 år, och jag var på den 400-500-förändringen och jag har att säga saker. Det var en ganska skönt sak för en analytisk person att göra, men det var det jag gjorde. Det var ganska bra. Vi hade launchat stora förändringar i stora förändringar. När jag sa att de här förändringar inte skickade, så hade de launchat förändringar och så hade det alltid varit något annat. Det var en nya CEO, eller en budgetkrunch, eller en takover. Det var alltid något. Jag trodde att det var jävla. Här är de här förändringar fulla av intelligendära folk som gör lite svårt. Är det någon intelligendära liv på planetet? Är det intelligendära förändringar? Jag började fråga. I Dukas stämde jag på Agile i 2008. Jag trodde att det här var fantastiskt. Vi har följt ut hur att lösa den sensuella managementkonundrum som har stått i den 20-talet. Det är hur att ha en fortsatt innovation med disciplin. Agile fanns en mål och replikat. Det var något som sker. Det var en accident. Agile fanns en mål att göra det systematiskt. Jag trodde att det var fantastiskt. Jag skrev 2010 en radikal management om det. Det hade två recepter. One reception was in the Agile community which was Yay! Everyone loved it. That was gratifying. But then I'd go to places like the Drucker Forum which is sort of general management.  This stuff will never work. It might work until those people in the basement with blue hair and tattoos doing software. It might work in tiny little teams. But it's never going to work in big organizations. Big organizations, we know several thousand years of human history you have to have top down. You have to have control. You have command.  That's what big organizations are always going to be. So go away, don't bother us. This isn't going to work in big organizations. So I said just you wait. I think by 2020 this will have taken over the world. This idea is so powerful it will it will prevail. And they laughed at me again. And in the next couple of years I thought, well why don't I get together with big firms that are actually making this happen than doing it. So I helped form a learning consortium of firms around the world. Small group of firms, rather large firms Microsoft, Ericsson, Barclays and whatnot. And got a sort of a forum where they could share experiences and figure out what works and what doesn't work. Because there's a whole lot of noise going on about agile, a whole lot of people talking about it. And it's difficult to figure out what's actually going on. So I thought if we actually got together in a private space we could then figure out what is really happening. And so we did that. And convinced me that in fact yes this was taking hold and it did work in big organizations. And there were many problems to be solved but it was so much better than what had gone before. It again had enormous promise. So if you fast forward to 2017, 2018 what you see you see that the the five biggest firms on the planet by market capitalization happened to be agile. Apple, Amazon, Facebook Google, Microsoft those are the five biggest firms on the planet right now in market capitalization. So now I go back to the Drucker Forum or to McKinsey in those places and say look you told me this wasn't going to work and the biggest firm. Here are the five biggest firms in the world and guess what, they are all agile. So this is ahead of schedule instead of 2020, 2018 we can say that agile is really here in the mainstream. So this was the assurance that we'd been able to make this progress. There's still many problems obviously we can talk about all the issues we still have to face but I mean there's been tremendous movement not just the biggest firms in the world doing it but now the Vatican of Management, Harvard Business Review that has three articles on agile and this current issue we'll have another article next month. McKinsey has just published a book it's a pretty silly book but it nevertheless does say that agile is really the future among other things which are less sensible. So this really is happening on a large scale. It sometimes doesn't have the same name and there are firms that are calling themselves agile that are not agile obviously I cited the Lloyd's survey where 1,000 executives all around the world the result was that the percentage of firms that want to be agile 94% the firms that are already highly agile 6% in terms of implementation there's a huge gap but this is where people can now see this is what is needed in a sense to succeed to flourish in the world the old way of running organizations doesn't fit anymore and there's a different performance requirement and there's a different way to deliver on that requirement I'm also currently sort of working on a film with my producer of the film Araceli de Leon I just say a word about what our documentary film on agile to help spread the word about how this amazing thing is happening in the world Would you like to come up? Thank you very much it's a real privilege and a pleasure to be here with you it's nice to see that there are some ladies in the audience too I'd like to see that and I am a filmmaker I am an economist I also work at the World Bank so obviously it's a place where people completely abandon economics and then go on to do something more interesting and so I'm not the only one I'm a good company I am not I don't have a background in software I do not have a background in agile so I'm here to learn this is this is a little bit the purpose and I'm here to ask for help for your help and your help is nothing money it's in identifying good narratives that we're going to put on a movie or a wide audiences because this is a very big message it's a message that says that there is a better way to work and one of the things I hear from people who in your trade is that it attracts somehow people who who like to collaborate who like to create a good atmosphere at work who therefore their work seems to be valued and their contributions to customer value are more evident and more transparent and that's fantastic I'm going to have a new granddaughter maybe next week and I'm thrilled I want to do this for her I want to contribute to make this a mainstream atmosphere in the workplace this is a fantastic message the movie is for the general audiences therefore it may not have all the detail that practitioners from agile feel should have so we're not going to go into the detail of why this particular agile adoption didn't work because the boss or something we're going to have a bird's eye view of the concept and I find it very persuasive I find that I want to know these are the questions I want to know I want to know what drives a company a traditional company a bureaucratic company to say we need to change it's a big decision it's not mine, it's a cultural decision it's an investment so I want to know companies that have that narrative I want to know is it just IT or has it gone beyond IT and maybe that's not a really good question and you have to tell me that because I'm asking because the internet of things is making IT a core function it's not just something on the side anymore so maybe that's not a really good question I'm looking for companies that are visually attractive so maybe there's a great story and a pharma company well if they kill somebody maybe there's some drama there but basically something like Lego is visually fantastic but it's not the only thing you have to have a real story something that they try to transformation it worked, it didn't work somebody didn't like it so it has to have all these elements so my asking you for help is I'm going to put my cards on that table contact me if you think you have something interesting that you feel that could be in the movie that could interest the whole world that would help spread the message just write me an email should be an email and we'll get in touch she's going to make you a star thank you okay so Steve is this your first visit here in the Nordic countries when I was at the World Bank I used to come here all the time I was designated as the World Bank representative for the Scandinavian countries for the African region so every September I would come and visit Copenhagen Stockholm and Finland yeah so I Oslo so I was I would come here and it was very interesting because we had kind of the same conversation in the four capitals each year and Oslo was the same conversation we got the different slightly different nuances between the four countries so I sort of had a test of visiting Scandinavia back then so I used to love coming here but I never stayed long enough to actually see what was there I'd be rushing and have meetings and then rush out again so I still have a lot to learn but I enjoyed coming here and now that in the learning consortium I mean why am I here now I mean in addition to meeting you guys and girls it's a meeting of the learning consortium these firms that have got together to find out what's going on so we're meeting with Ericsson and having a side visit to Skania Wednesday and then we're heading off to Copenhagen and we have a number of workshops one is on leadership storytelling and then two others on Agile and Nature of Agile and all of that and we're working on the film and trying to find attractive sites and people and things that would actually fit into a film So you mentioned you've written a book already which was called Radical Management just a few years ago now you're coming up with a new book it's called Age of Agile so what made you decide that this is the right title for this book and what does that title mean to you Well in 2010 Agile was really quite contested territory and so it didn't seem then that Agile was the right topic so we had an argument with the publisher and they eventually settled on the leader's guide to radical management and many people hated that title I mean all of my books in fact they've hated the title everyone has a different idea what the title of a book should be except this one I got this idea from a talk given in the Drucker Forum in 2016 by English professor and he said look that's what's happening we are now in the age of Agile bureaucracies are dead meritocracies are dead we are living in the age of Agile I said oh that sounds interesting he went on to write a book called Fast Forward okay it's not the title of your book it will be the title of my book and I have yet to meet anyone who doesn't like this title so as opposed to my previous books where everyone hated the title I finally stumbled on a title that everyone liked because it does signify that this is something quite large this is something that is not just some management gadget it's not happening in a tiny part of organisations this is something that is affecting everything the way we live, the way we work the way we understand how the world how the world fits together so it does capture that and it's from a literary point of view it has assonance age of Agile so it has a lot going for it so if there is anyone who doesn't like the title I hate them a ton it's been helpful in terms of signifying this is something quite significant that's going on in the world so when you did the research for this book and I kind of started thinking about putting this book together what were some of the key learnings that you really decided I need to feature these key learnings because they're kind of the main message but since 2010 I've written over 700 articles in Forbes so it wasn't so much of what what was I going to write about it was more of all of this tremendous wordiness what were the main messages what was the critical thing and the scene changed quite a bit when Harvard Business Review wrote an article about Agile in 2016 and Mackenzie had a big Agile hackathon 1500 people that sort of sent a message that Agile was really there so that was a signal that this was something that you could actually talk about and this would start to to recognize the it's also things have moved along quite a lot in terms of just the I mean the role that Apple and Amazon and Google and Facebook and Microsoft play I mean five years ago they were not the dominant firms in the stock market they were big but they were certainly not the biggest and so this whole thing has moved along and quite and part of the struggle has been to keep track of and to have something that is is really up to date and so it's more a question of selecting and I think it starts off by saying that the world has changed in the sense that now everything and everyone is can be connected with everything else and everyone else and this is something that we're only just scratching the surface of the implications of that that means that the whole world is going to be reinvented and parts of it we can see but it's going to be much larger and what it means in the in the business world is that once that becomes possible it starts to become necessary and the business success which used to be about doing something which was pretty much okay and you could sell it and that was okay now firms need to be if they want to flourish be having instant intimate frictionless incremental value at scale instant intimate frictionless incremental value at scale in other words you need to be able to people want to find things immediately you don't want to have to wait around people have become very urgent they want something that's personalized to them they want something that is is getting better and in fact they want it cheaper and if you're in if you're in business that is the performance that you need to be aiming at and most big firms are not delivering that and don't have the capability to deliver that and so their future is somewhat gloomy unless they change at the same time in the agile world there is a harsh lesson that the book has that the assumption I think of the founders the movement agile manifesto assumed that if we wrote better software we would make better products and we would be duly rewarded in the marketplace we would get financial returns but what I just described to you in terms of the this new marketplace in which the customers are in charge of the marketplace and want better products at lower prices and have options to go elsewhere if you don't deliver that it means that that whole assumption that if we do better work we will be rewarded for it is not materializing and there are many many firms that have discovered that to their grief that simply doing better work making better software is not by itself the secret of success and that one needs to be finding new markets new customers what I call strategic agility market creating innovations that you enter a new field where there is no competition in which people are willing to actually give you some value back in terms for all the effort you put into your products and services so that is a whole set of lessons and discoveries for the agile world so I think we're all learning and there's no room for complacency simply being agile is not the answer that's part of the story but it's only part how can traditional companies lagging behind how can they take back the place in the market is it at all possible for them to change what do you think they should read my book what is the most important thing that they can do now except for reading your book no they well you see I mean as I said 94% want to be agile so it's not like I have to persuade them to want to be agile they want to be agile so the problem is how it's the gap between the 94% who want to be agile and the 6% who are agile that's just 88% we have to work on and we were talking on the way over here as to whether there are some people that it's just impossible for them to learn that only death or retirement will solve the problem I really don't think that's the general case I think that certainly people are entrenched in their habits and their attitudes and their goals and their values but they can learn the the marketplace is a harsh teacher and most firms the reason why the 94% want to be agile is they can see they have problems so it's not like I have to point out that there are problems what happens that when they look and see what would be involved in doing this it's so different it's kind of like visiting a foreign country where the customs are all different where no means yes and a smile means anger and you can't make sense of this well where letting go of control increases control focusing not focusing on making money ends up making money all of these very strange kinds of customs which are in this new foreign country is just difficult and some people some managers just grab it and say wow let's do it let's start tonight and I meet people they wouldn't run home to their spouse and say I had this most amazing thing amazing work we're going to change everything in this organization and the spouse is sitting there wow and then he says well we're going to start in our family and we're going to have scrum in our family and we're going to have a scrum tonight and put some of those people in the film and but can they change fast enough when they die well obviously there are going to be some casualties it's partly intellectual learning but it's partly also they have a different muscle memory and you just can't change something I give the example of the backward bicycle have you heard of the backward bicycle those who haven't it's the bicycle that when you turn the handlebars right the bicycle goes left and so you know intellectually and if you want to go left you turn the thing right but when you actually get on the thing you simply can't do it you cannot make the adjustment in your muscles to do what you know you have to do intellectually and so there's a very funny video on it so you can watch that and the guy who sort of discovered this he actually spent nine months trying to learn to ride the backward bicycle and at the end of nine months one day he woke up and suddenly he could do it suddenly he clicked and he could ride the backward bicycle the only problem was now he couldn't ride a regular bicycle but that presupposes that oh I lost it sorry presupposes you know what to do and you want to do it it presupposes that you're motivated to do it I wanted to say that you want to do it and how do you make what's the carrot for these managers who are losing everything when the company becomes agile well they they're not losing everything in the short run I mean they're still getting their bonuses they're still getting paid and the retirement's not so far away and if they just hang on they may be able to make it so that's not like there are no incentives and when everyone around you is acting in the old way I mean there are tremendous pressures to keep acting in the old way but I say it's you see many cases where people who you think will he or she will never change but I go there and wow they have changed I mean one of those I know was actually knew intellectually that he needed to do it but like the backward bicycle he just couldn't seem to get the hang of it and he had a coach maybe one of you guys even and was he do something or ask the coach suppose I did this the coach would say well you could do that but that would make it really bad so I'd go away and think some more and then suppose I did that the coach would say that would make it even worse he couldn't really get the hang he knew what he had to do but couldn't get the hang because in this mode of giving instructions just couldn't get the hang of it but then he went on vacation to spend his time reading the books and then he wrote to the coach and said well suppose I did A B C and D the coach said right now you've got it now you don't need me anymore now you've got the hang of it so the penny sort of finally dropped like the backward bicycle so there are cases like that there are obviously cases where it's a long slog and reversions this is difficult to change behavior I mean one of the most celebrated implementations is that Menlo Innovations with Richard Sheridan but he admits that quite often he slides back into non-agile behaviors so it's not like someone who's known that who's dedicated his whole life to doing that every now and then he slides into different ways of doing things so this is difficult even with the strongest possible motivation so if it's about behaviors then I guess that HR will be more important in the future and their role and you recently wrote a couple of articles around agile HR do you like to comment on that? yeah I mean I let's say it's more than behavior I mean I sometimes give a three word talk agile is mindset that's my talk and I will answer questions it's fundamentally about mindset the behaviors flow from from the mindset and the mindset has the book suggests three main elements they're so important in laws and one is that total obsession with delivering value to customers and in users second descaling big problems so that they can be handled by small cross functional self organizing teams getting feedback from customers and then thirdly that the whole organization functions as a network not a top down those are the three most important elements that I see in this mindset but it's a mindset that leads the behaviors now I think the firms in the learning consortium probably didn't pay much attention to HR when they were doing their agile journey I would say for a number of years they thought well those people are irrelevant they don't understand this they will never understand that they won't be helpful and we'll just ignore them but over time they saw that these back office functions HR and budgeting caused a lot more problems than they had expected and so there is now quite a bit of effort going on to say well what would agile management of people look like and how could we make it something that's adding to agile instead of trying to minimize the damage that they do and because in most of the firms the HR practices are very non agile very bureaucratic very doing everything the opposite of what you are trying to do and agile even the name human resources this is like calling the finance department the fraud department because you are calling the thing the very opposite of what you are trying to accomplish you are treating people as things resources that are going to be mined by the corporation and then thrown away after you have mined all the good I mean the very name is back to front and all of the practices grew up in the bureaucracies where the HR was acting basically the executioner on behalf of the top management you need to fire 3,000 people right we'll do it cut salaries right we'll do it whatever you need to do HR will be do the dirty work and the organization often acting as though they were the friend staff but there was a lot of fear and loathing in relation to HR department so against that background kind of nowhere to go but up right can't get any worse than that and what you see in the last article I wrote about vista print that really they have taken the whole sort of mindset the heart and really rethinking I mean what would it take to make the people management really a part of this and vista print as a about 5,000 people it's not a huge company but it's growing quite rapidly and because it doesn't have a name like Google or Apple they have difficulty recruiting best talent and so the challenge and the people management is to create an experience at vista print which will first of all attract people will have that experience an experience that delivers value to the customer and that is aligned with the kind of experience they are trying to create in the customer the people management they call themselves the talent and experience team and they are seeing the experience of being in this organization is their product and it's not a project that they are implementing that has to be done by a deadline and then it's finished and then what's the next project this is a continuing goal to make the experience of working in vista print something that you will sort of remember for the rest of your life this will be a peak experience and people will want to come to vista print to live that experience that's the kind of thinking that they have got going it's a work in process there's still many things they have to work on but it has been that those people are embedded in the business they are working together with the agile coaches and they are part of the business they are not some function on the side that is causing problems they are acting on a daily basis to solve problems and most importantly I think they are turning the saying that performance evaluation is the responsibility of the individual it's not the organization evaluating the staff member themselves seeking out how they can improve how they can contribute more value to customers instilling that throughout the whole organization is a huge challenge and the HR formerly HR now tell on the experience that's what they are busy doing trying to rethink everything in the organization so that that's the way people think that I'm not here to be evaluated I'm here to improve myself I'm here to get help on how to deliver more value to customers and have an amazing time and when I leave Vistaprint I will then go around the world and go to Stockholm and tell people what a wonderful place it is to work in Vistaprint so that's a case of a fund that I think is quite far long in terms of really taking seriously agile principles and reimagining what people manage but could be like should be like and is in fact becoming a reality that's a long answer yeah it's a good one Vistaprint will be coming to the agile people conference in fall so you got a chance to hear more then I have one more question if we're going to open up to some questions from everybody else here and I've had the chance you mentioned what was it 700 plus articles oh my god that's a lot of production I've had the opportunity to read a few of those over the years I must say it's been quite enjoyable you write with an edge and sometimes a little bit more than just the provocateur so I just want to ask you about that writing style is that just your personality or just that something that's been developing all the time I don't know you can ask my friends hahaha I mean it's I was always trying to get the right balance I mean if I write something that really offends people how helpful is that how constructive is that so I tried to have a sense of humor with the edge and I tried to look at these challenges sort of constructively I mean right now for instance I mean Mackenzie has produced this book which sort of endorses Agile but has a lot of silly things in it really stupid things and and so what do I do I could write a slashing article pointing out every stupid thing in the book or I could ignore all the stupid things in the book and point to the fact that they do at least endorse Agile as something that has potential in the world and they cite a couple of companies that are I think doing it extremely well Facebook and here the Chinese firm or I could have a a blend of the two the positive things but also point to some of the the things that could have been stated more effectively let's say so I'm always struggling as to I mean to get into a big fight with Mackenzie probably isn't such a good idea but on the other hand someone needs to say look this was wrong to say that you implement Agile in a top down fashion telling people what to do that is not Agile and someone needs to say that but to say it in a way that Mackenzie doesn't get so totally offended that we get into a stupid fight yeah again imagine there's a difference between poking the bear and just maybe tickling it and getting a laugh out of it with that we're gonna open up for some questions so who's gonna have the first question so please be loud and I'll repeat the question so the question is did you have an imaginary reader and a target audience so the question is did you have an imaginary reader and a target audience to be able to select from all these potential viewpoints and messages the primary audience are two million managers the agile audience I hope that they will also like it and I hope they'll be helpful to them they can use it to persuade these reluctant difficult managers who need to get on the same page and so I see there's a tool that they can use to to help move this agenda along and so it's but it's basically aimed at trying to speak to managers and say look this is the future this is the way organizations are going to be you can either get with it and flourish or you can fight it and be crushed those are the long term choices and here's why and they're very solid economic, financial, social reasons why this is so and so why don't you join the parade and I'm always uneasy when I sort of get in front of people like you who know so much more about it than I do and I was in Boston with Agile New England and so there were people like Jeff Sutherland in the audience one of the signatories of the Agile Manifesto so I'm always nervous that he might leap up and say that's not what the Agile Manifesto said you are you are challenging and putting in question some of our sacred beliefs you changed the language of the Agile Manifesto but that didn't happen and he's been very helpful and in fact almost all of the signatories of the Agile Manifesto have been helpful and supportive and happy to see the thing move along that they're not sort of locked in the past but there's always a danger that someone will rise up and say this isn't Agile I have to fight I have a question for you Steve that was in this area you said you had your own experience about storytelling and that's how you got into this I was curious to hear what's your own experience about Agile in your own organizations or what you have done yourself not just looking at what others are doing and evaluating but actually doing yourself I mean I learnt enormous amount from being with these companies and the learning consortium and so I found much of what's in the book has come out of those experiences those stories, those narratives and one of the stories which leads off the book is from Spotify which I think is at least so far the best single story about what Agile is and this was the Discover Weekly that probably not better than I do in 2015 Spotify that done very well had 60 million users but growth was slowing and there was a problem people were spending most of their time searching these 20 million songs to try to find music they would like rather than actually listening to music and this was something that was really beginning to slow the growth of Spotify and unless they could do something about it the future would be quite bleak because they had these big competitors Amazon, Apple, Google starting to come on the scene along with Pandora and all of these firms had this problem so they all knew it was a problem and the management of Spotify knew it was a problem and they had the hypothesis that the solution in having better search function this would enable people to find the music they love and they had around 100 people working on this but a couple of people at a hackathon said no there's a better idea why don't we take the classification of the 20 million songs that we have take all the information we have about what music individual user loves and every week give them a playlist which would be the 30 songs which we think they will love the most and the management of Spotify didn't like this idea they thought it's never going to work it's simply too complex a task and Apple has already got into a lot of problems by inserting music in the iPhone that you too you think that people didn't want so this is going to be cause all sorts of backlash so this is not a good idea so in a traditional organization that would be the end of it that would be the end of the discussion and you never hear more about this idea but in this case in Spotify there's a lot of latitude for teams to keep exploring ideas that are focused on delivering value for customers so they went ahead and worked on it and within a month or so had actually put together a prototype which they simply inserted in the playlist of the Spotify staff there was no announcement there was no big declaration no public relations about it they simply inserted it and then people in Spotify suddenly started finding this playlist to discover weekly and wow it's amazing what's in there and so there was this whole buzz within Spotify I mean what is this, who did this how did this happen and so that then led to proposal why don't we do an experiment on 1% of Spotify users and bingo it was a huge hit with them and so four months later they did this to all the 60 million users of Spotify and it was a huge hit 21 languages 15 time zones all around the world people are waiting Monday morning to get there and discover weekly and this had this huge increase in users people loved this I mean the reason I found out about Spotify my daughter told me that you've got to get this discover weekly so it was that kind of thing that happened all around the world so that is how they got to 150 million users that's how they got to have a successful launch on the Wall Street two weeks ago with around 30 billion dollars that wouldn't have happened if they hadn't been able to discover weekly so that's an illustration of Adjan in action having huge financial gains with an idea that totally would transform the relationship of users to Spotify that's the example of story that's the best story I have about Adjan if you have a better story about Adjan I would love to hear about it so what advice would you like to give an organization of this one of this 88 percent that are still left there or maybe to a coach or consultant who is working with transformation from my experience the way we are implementing something is often more important than what we are implementing so have you seen examples of non-agile implementation of agile or you understand what I'm saying what advice would I give them I'd tell them go and talk to crisp no there are obviously lots and lots of very bad implementations of agile and I think it's quite important to identify that and call it out and say that is not agile that is bad stuff and I've done that's part of the edginess of my articles trying to say look that's that's not right there is a lot of stuff in this McKinsey book that is exactly like that you implement agile by driving it from the top and telling people what they have to do and what behaviors they have now expected of them that doesn't work in my experience those end up in quickly failed implementations the only success that I've seen is really where it happens organically within the farm you you have people not just at the top but typically in the middle or upper middle part of the organization who have seen the future and are convinced this is the future and become champions and initially when they do it they are they are pariahs they are lepers they are doing things the wrong way and often they have to do it in the dark of night and undercover but in due course they in the successful cases the higher up begins to hear about it and is willing to support it in the successful cases that's what happened Microsoft that's what happened 2008 there was one guy the vows of the the visual studio saying this is never going to work they brought a product to the market and found that someone else was there way before them instead we have to do things differently so it's one team in 2008 another three teams to do it in 2009 2010 visual studio 2011 corporate vice president said the whole developer division began to go agile and then in due course Satya Nadella developer division and so he 2015 became the CEO Microsoft so there was this organic movement within they had a lot of coaches to start with but they owned it and all of the examples in the learning consortium where a process has been ignited or stimulated by coaches and whatnot but the the continuing apparatus comes from people champions within the farm who believe this is the way of the future and will fight to the death to make it happen but it's organic within the farm so finding the champions finding actual champions finding potential champions I see is critical to making this happen so at the beginning of this talk you talked a bit about this idea that was going to change the world by 2020 it sounded like you had a really clear idea idea of what that idea was can you talk a bit more about that well it was what I wrote about in the book of radical management I said the hero had the seven these seven principles I think by 2020 these seven principles will be will be dominant and of course what I found was that seven was too many I immediately had to reduce it to five my presentations and then last year I got it down to three three laws and now it's three words of agile this mindset so I had to simplify the message quite a lot but I mean obviously with only six percent of farms highly agile we still got a long way to go but when the biggest firms in the world and the fastest growing firms in the world are implementing these principles I mean it's only a matter of time for this thing spreads much more rapidly what is that agile was the question I mean my definition basically it's a mindset that embody these three principles or laws that's what I mean by agile so if you have been useful I think it's just a way of looking at organizations to start to say well is this firm agile and you might say well yes they have a lot of teams that are doing pretty well so that's good but it's a firm that is still focused on maximizing shareholder value as reflected in the current stock price so that is direct opposite of agile objective so this firm is not fully agile in that respect or was that a firm last week they have that down they have the goal down they have the small teams thing down they don't they're still struggling with trying to turn this hierarchy pyramids top down hierarchy into something where information can flow easily sideways upwards downwards so it's obviously a tremendous simplification even over simplification of a very complex subject but I think it's been helpful to me and to others to sort of arrive converge on those that kind of summary of the principles because then you can start to have a discussion what is fake agile and what is not what would you say is the main reason why one should even bother about the companies that tries to be agile and don't understand it and instead just let them die their own death an ugly brutal agonizing death that would be so satisfying and some companies I would love to have that happen to them but it's happening to them anyway why should I even bother and instead why not focus on supporting businesses and companies that actually do have some level of understanding or even why don't focus my energy on creating my own business with people that share both the values and knows how to implement those values in practice I think there are huge social costs in letting these organizations die in some of these organizations which are dying like GE and IBM I mean there are wonderful wonderful people and they are amazing expertise in these big old firms and you could say well those people will end up somewhere else well maybe but my take is that there are huge social costs in letting those big old firms or encouraging them to die rather than saying why don't we try to help them see the future obviously there are people in GE and IBM who very clearly see the future and are desperately trying to accomplish it and trying to prevent these dinosaurs from dying but they've been running into some serious roadblocks so it's touch and go whether those firms are going to survive I would say but there will be huge costs if IBM disappears or GE disappears off the planet I mean there will be huge costs which are really unnecessary costs and at this point we know what to do it's not a matter of not knowing it's something that can be avoided I'll just slip in a comment the saying goes survival is not mandatory has been said before and we are living in a world that software programmer is the most common profession in Stockholm and has been for something like 8 years and people say software is eating the world these grandiose statements could be a very good thing we also have the case that the number of people involved with tech today is very high compared to 10 or 15 years ago so if you want to find somebody that's highly experienced and had a high level of mastery when they got into the business it was quite small so there's not that many of them there's a big learning curve here and there's a huge challenge there's pressure to learn how to do this so how do we bridge that gap given what you just said well yeah I mean the differential between the beginner and the advanced performer is so huge I mean there is there's a tremendous battle for talent and I don't know what it's like here in Stockholm but in everyone I talk to if I find someone who's been involved in some interesting development in some firm and I try to contact them where are they they're not here anymore i Amazon and those big firms Google and whatnot just sucking up just sucking up all the talent and so there's certainly a need to learn faster I don't have any magic answers as to how to make that happen maybe a lot of its experience would be my guess is that there are some people who will be naturally gifted but for most people it's a matter of learning by doing that's not gonna happen overnight but anyway we could accelerate the learning that's gonna be crucial yeah so going back a little bit to the financial side of things you started today with telling a story about how you started in the world bank with the target of ending world poverty and now we're working in the end age of agile where good values and good principles are actually the side effect of that that we are helping the companies to accumulate even more financial resources under a few umbrellas beyond the age of agile do you see extended value for the end user for the customer we're struggling with quality of products we're struggling with the effect of our products on the world on the environment and so on do you see this and have you been spending time with those kind of thoughts well I have this article which was first published in Forbes published today in LinkedIn addressing this rather cryptically but nevertheless addressing it and saying that firms need to be considering are they delivering value for customer are they creating exciting work spaces but what are the social impacts of what they're doing it's not the only thing they should be thinking about but they should certainly be thinking so Facebook wasn't thinking about that and has now gone through some tough times and I think will face some increasingly tough times because it didn't pay attention to the social impacts of what they're doing and Google has been crashing competition by just buying firms up and so these firms will if they don't deal with that there will be consequences and there will be serious consequences even if it doesn't look on the surface I mean I think Zuckerberg never wants to spend a week like he spent last week ever again in his life and so what will happen is that there will be lawyers in Facebook attending meetings you can't say that, no you can't do this, you can't do that and this of course is what slowed Microsoft down that these hearings even if they don't lead to legislative action wake the companies up they can really stifle innovation I mean that's in the sense what created Google if Microsoft hadn't been slowed down maybe Google wouldn't have existed would have been Microsoft so firms have to pay attention to the social costs implications of what they're doing and if they don't there will be grievous consequences for doing so so I think the privacy law in Europe will really slow down to get to Facebook in a major major way I was thinking maybe we should take a small break and let you rest a bit have something to eat maybe and we may continue afterwards with more informal discussions we'll think of something to do in the meantime hahaha okej


Good day, quick question Emily since we seem to be anticipating a new people joining today Should we do the quick round table slash introduce yourself oneself at the beginning rather than the end like we usually do or is there any preference? I'm usually when we have our first meeting after a security day event where we get a bunch of new members We usually do introductions Before especially if we do we have a really light agenda like today And then We usually talk about ways that new members can become more involved And I think one other time that we did it We had some of the pre-existing members talk about like why they joined and some of the things that they have done to help Inspire new members to be more involved But it's up to you how you want to do it My recommendation would be have everybody go around introduce themselves as either a new member Or what they're doing in the SIG It's a good idea. I'll take that advice. Thank you Hello Good day, Brandon How's it going? Um, Matthew are you going to be um, uh facilitating first day? Sure, uh, yeah, I will just today. Yes, unless anyone wants to grab the mic since it was just a big event Whichever works best for the team I had to turn my video off for just a little bit because I'm balancing a nine-month-old in my left arm And he keeps trying to kick uh, he's managed to kick my uh, usb thing unplugged and I had to restart my vm So that was a thing So I'll give a couple more minutes before we get things underway and I'll do a little recap at the very end In case anyone uh, John Layton wants to introduce themselves It looks like um, so far. It looks like the friendly usual usual crowd. So let's see Maybe people um to conduct Okay, good day everyone we're about four minutes in so I think we'll get things underway I think my webcam just disconnected. Can I confirm my audio is still coming through? Yeah, we still hear you Thank you So uh, taking a suggestion from Emily will change the format just a little bit today Since it was just a major event About Native Security Day the other day But the first thing I just want to ask is if anyone Would like to volunteer to be a meeting minute taker slash scribe I posted a link in the group chat to everyone to a link to today's agenda And if anyone wants to grab the scribe rule that would be appreciated just so we can take minutes as we go along I think Beautiful. Thank you. All right So today what uh, we will just start things is I was just going to go through um Alphabetically through the list of attendees And whether someone is a new person to seek security and would just like to introduce themselves or mention Why they joined or what interested them Or alternately if someone's already been a member of the team for some time now and we'd like to give just a quick elevator pitch slash spiel of uh, why they joined or what they Gain out of being a member by all means and if uh Rather not just mentioned no update and I'll just uh move on to the next attendee So With that, I'm just going to go alphabetically down the list unless anyone wants to jump in Ash may Send the mic your way Might still be game set up. I'll move on. Uh, yeah, look like a couple of people Connecting. Oh, yeah, I can start Um So so kind of just a quick introduction. Um My name is Brandon. I'm from ibea research. Um And I work on container slash cognitive security stuff A lot of my background is around image security. So signing encryption Stuff like that. We are also working around trusted platform components so things like Attesting hardware all the way up to the software stack. Um being able to figure out what What machines are being run by talking to the tpm and things like that um, so that kind of stuff. Um, and so sick security is is Um, kind of a place where a lot of these discussions also happen. That's I get a lot of the discussions that happen here Um, I first of participated in security assessments and things like that. They are really fun experiences Is something that it's easy. It's something easy to kind of jump into as well um Other than that, I think who we have a ton of other activities that I think Emily will Um, we'll talk a little bit about sick security day Uh, and the white paper. So Thank you Brandon, uh ash Would you like to do a quick introduction? Uh, yeah, sure. So i'm ash narker. Um, I am one of the maintainers of the open policy agent And for those who don't know it's a open source general purpose policy agent Uh, so if I want to contribute uh to policy if you're interested in policy enforcement Uh, reach out to us join the opa project and if any questions feel free to ask You're on the open slack. Thanks Thank you ash Uh onward Dan, would you like to provide a quick introduction? Hi, i'm dan shell. Um chair here at uh, six security Been involved in this. Um now for you know coming on three years. Uh, and uh um You know This sort of draws upon my background, uh in security and It's been a you know, great opportunity to sort of blend uh kind of a decade of experience On the app side of things and You know help ensure that we're building on a solid foundation of security first Thank you Dan Next up we have emily I am emily fox. I work for the us national security agency. I'm one of the tech leads in sick security I am one of the co-chairs for security day And I am the lead for the cloud native security white paper Thank you, emily Next we have gadi if I got that right would you care to Choose yourself Sure. Uh, hey everyone. This is gadi here. Um by way of background Presently i'm the cto and one of the founders of uh, al-sid um, which is a company that is purely focused on security for kubernetes and service mesh so mainly focused on runtime security security on the kubernetes audit log and everything in between and presently Uh, I am participating in the cloud native security white paper Thank you Next up we have justin gadi justin Hello, um, so i'm justin come back. I am the um cnc of toc liaison for sick security as i'm on the toc and i've been involved with sick security since um quite long time ago before it was officially sick security um, I also maintainer of natury project and interested in supply chain security in particular among other things. Um And um, yeah my day job. I'm at docker working on containers Thank you, justin Next we have mark. Good day mark I'll come I'll come back to you mark. Uh, uh, you'd like to do an introduction Uh, next we have pratik. Good day, pratik sorry Hey folks, uh Myself pratik lotia. I work for charter communications, which is an isp in the united states Uh, been working on some container security stuff at the company focusing on secrets management a bit of service mesh uh Container scanning and things things like that. I've attended a few of the working group so far and So far it's been doing great and i'm eager to get more involved with the community Thank you. I see mark's uh cameras on there mark. Would you like to grab the mic now? Sure. Hey guys, sorry about that. It was hourglass time for me So i'm uh the innovation security guy at synchrony, but i'm really representing myself in this group Uh, I previously have collaborated with nist on some of their Work and also the dev ops security standard with eye triple e so I kind of bring the external standards conversation into these meetings Thank you mark Next I have michelle Michelle, would you like to introduce yourself? I'll come back to this attendee. Uh We're all just getting our mics working Next we have ray ray. Would you like to introduce yourself? Hello, uh, I am from uh rxm. We are a cloud native consulting training company I'm also an active participant in the kubernetes project Being part of the 118 release team and the current 119 release team as well I also um actually Participate in the in the documentation of kubernetes with the website Um, and i'm actually here to uh learn more about security to be more security minded because as a developer in the past I haven't always been so I figure this is a good place to start Agreed thank you ray And next we have robert robert. Would you care to grab the mic? Sure. Hi, uh robert feccalia. I've been involved with six security for gosh about the last year maybe longer at this point I'm co-chair of the policy working group Uh, where we look at uh specifically kubernetes related policies and more broadly how that maps to different compliance frameworks and policy validation uh for this group, uh specifically leading the cloud custodian uh security review process So i'm i'll get on my soapbox and ask for volunteers if you want to try the process here at sick security to review one of the cncf projects We're looking for all the help we can get And you can join the the slack channel for sec assessment Uh custodium. I think I I put that incorrectly in the notes and let it look at it So i'll correct that But if anybody wants to to chat or speak up, uh, we're happy to have some volunteer help on that effort Thank you robert. Would it be possible to also throw those links into the group chat here in uh zoom? Uh, yes, i'll uh, I think i'll link that to the github issue And i'll probably be the most expedient Okay, thanks again. Yeah, I dropped I dropped the thing for you robert Thank you And next up we have rohan. Good day rohan Hello there, uh, i'm rohan. I'm the head of security at control plane for a cloud native security consultancy out of london that was founded by andy martin Uh joined sick security to try to contribute to the cloud native security white paper that emily is leading Thank you rohan Next up we have tk. Good day tk Sorry, uh, can you hear me now? Hello Yes, you're coming through five by five Okay, thank you. I was on mute. I guess when I was saying yeah, I've been Sick security. I think for a while now um before it became sick security I think where it used to be safe group so forth and my interest is primarily coming from the security aspects of the edge computing So I am also involved in the IEEE next generation future generation networks for the looking at 10 years from now And in between I suppose and been working very closely with those things and i'm trying to make sure that they are aligned well, I suppose with the cncf working group so on the In case anyone is interested on the ingr. You can look that up in the edge fully The next generation networks and you will see some of the drafts that we are proposing And we're preparing there on the things and it's still at the very Initial stage, but we do have some working graph there as well Um other than that I present a consulting company on the edge computing basically So um we're working on those things and to make sure the cyber security is also aligned the edge side of it It's pretty much it. Thank you. Thanks Thank you tk And if you want by all means feel free to post the links to the drafts in the group chat if you if you want to Yeah, it's actually very easy to google search and ingr and IEEE because it's so Widely uh known true Okay, thank you. And next we have vinae. Good day vinae. Would you care to take the mic? Hi, Matthew. Thank you. Hello everyone. My name is vinae Venkatraagwan I've been part of the six security for about five months now since february this year, I guess and you know, I Wanted to you know contribute to the community bring over, you know 15 years of work in security enterprise uh, you know hybrid cloud cloud experience and I've also I'm also part of a Group at Palo Alto networks called prisma cloud where we help our customers secure across the entire Software supply chain, right, which is you know through the build deploy run phases So I thought it was very appropriate and the Someone one of the contributions I made to the community here is I presented a security reference architecture Which I'm hoping can have a place in the cloud native security white paper as well. So very excited to be part of this Great Thank you vinae and one personal just a loop back to because I don't believe they got a chance uh, michelle If I got that right, would you care to grab the mic? Uh, sure. All right. We've never done this intro thing before so freaked me out. Sorry. Um, and I mean All good. I'm in witness protection. Clearly. So, um I'm michelle teberka. I work for a large financial institution. Um, I I worked for another large financial institution for that one and uh, I have um, I work primarily on a self-hosted kubernetes initiative at this institution Um, and I'm an architect if that helps. I don't know what else you need to know So Thank you. I was it. Thank you And uh, if there's anyone I've missed on the list that would like to introduce themselves I think we're good, but if I've missed you, please feel free to chime in And uh, oh may as well introduce myself. My name is matthew jasa. I'm a Principal engineer and technical lead for essentially cloud development at my employer key site former lexia and the CNCF a security group is kind enough to let me facilitate meetings now and again And besides that my major interest is just learning the security landscape for kubernetes I come from more an embedded development background in real-time operating systems And now that i'm thrown more into the cloud side of things I find that just by taking part in these meetings and joining the team I Learned just how much I don't know and how to fill in those gaps as time goes on So it's definitely helped with my day-to-day career With that said, I think we've got all the introductions out of the way We already have our minute takers here And my intent was to move on to check-in slash presentations we have proposed for today My understanding is is there's a post security day update from emily as well as the White paper schedule bump and i'm just going to quickly check and see if there are any updates You have here See I believe all these were covered in the round table we just had So with that said, I'd like to pass the mic to emily Hey everyone I want to let you guys know that we had a really awesome cloud native security day at kubecon this year It was our first virtual event and With most first time virtual conferences we did run into some technical difficulties with the platform But I think probably after the first few talks everything started to work out things started to get a little better I think it was our first time using that platform. So everything seemed to be going pretty well As we moved throughout the day We had about 369 Folks joined the security day channel for kubecon Some really good discussions in there And at one point we had 230 viewers for a single talk We're waiting for to hear back from the cncf about What kind of transparency metrics they're going to issue about kubecon and cloud native con So we can get more information about how wide of an audience we reached with all of the awesome presentations from all of our great presenters I will be running a virtual retrospective Of security day and the security events channel And then we can close out that ticket and create a new issue for a sick security day 2020 north america As another virtual event. So if you are interested in potentially presenting Get ready. We will hopefully be putting that call out once we coordinate everything with cncf again So that's the update for security day and then next update. So I updated the cloud native security whitepaper With a new schedule All of our dates have been bumped out about a week to allow The writers and the contributors to have a little bit more time to put in some content With kubecon consuming everybody's time last week Wanted to make sure that we had plenty of time to get as much information pulled together And that's about all I have Thank you. Does that effectively cover both the two topics then? Yep. Okay, but thank you With that I'm just going to double check the check-ins. I don't believe we have any sig representatives with any check-ins today Okay, so we do not have any additional prs or presentations So I was just going to ping a couple people here on the call to see if they wanted to provide additional info on the items they previously covered. So I have What mark underwood noted here on this IR 8006 cloud computing forensic science challenges Mark, did you want to go into any additional detail there or all good? So, yeah, just make it quick. I don't want to give these let me shut up this other meeting I don't want to give these two products from this too much presentation, but they reflect Sort of sub-disciplines in the work that we do in this group that we don't always give a lot of attention to So one of them is a cloud forensic. So there's a This is not a standards document. It's kind of just a technical report on that subject and the other one is actually a tool. It's an installable executable that tries to treat the cyber supply chain as a As a graph basically with multiple nodes in it where each node is, you know, some facet of the Supply chain could be another open source project could be a person could be a subcontractor and so on dubious whether that tool is really great idea, but it gets you thinking about Alternatives ways of looking at this. NIST has some other documents around cyber supply chain It's it's a real problem, especially for bigger organizations to try to manage down If you're heavily invested in tooling to solve security issues You're confronted with the problem that your lesser capable organizations offer often offer a greater risk to you. So That's it. Just a couple suggestions Thank you mark And then I believe we have one last thing on here and then we'll just open the floor if anyone wants to grab the mic So robert's there was the mention of needs cloud custodian security reviewers Is there anything else we would like to add to that or it's already all covered in the previous discussion I Know I'm happy to reiterate We'd love to have folks participate in the security assessment process So if you've been curious about it or you've kind of watched from the sidelines It's a it's a very low risk way to participate Kind of roll up sleeves a little bit, but we'll The ask is very low and of course the more volunteers we can get the more we can distribute the load So if you have any interest at all, please don't don't hesitate to join the Slack channel or comment on the github issue and I'll reach out to you Or speak up now I'm curious what type of assessment is involved Like I've not done any assessments previously. So I'm just curious. What does the work involve? Yeah, so the process that that we here in the sig have laid out is the the assessment process is really reviewing documentation provided by the project in this case cloud custodian On how they manage security how their how their project aligns with some of the common practices the ci i initiatives And you know, we as a team will review that documentation See that it maps to expectations discussed what those expectations are and then really come back with a a Some feedback to the project That we will review with the toc and present to the toc and You know what came out of that in previous assessment rounds with folks like opa and key cloak and such as a set of maybe concrete recommendations around either documentation or implementing different ci i initiative improvements and getting to a certain badge or adding Some additional tooling or and I think in a couple of cases some github issues to the project around a particular threat that was identified I see yeah, that that helps a lot and I think Brandon sent some links as well So I'll check out those definitely sounds interesting. I'll reach out to you on directly on slack for that Great fantastic. Thank you. Okay with that exchange we've Covered all the items we have on the agenda so far for today So at this point I just like to open the floor if anyone would like to bring up any specific pr's that require attention Or if there's anything else that needs to be raised. Here's your chance Yeah, I just No, I don't want to just add a quick note. Um, I think for for those that are new Um, that we have a new members Um, kind of section that's in the read me that should be helpful Um, also, um, there were mentions of slack as well. So we have on cncf Slack and the channel is sick dash security and within that channel actually if you go into um Go into one of the The pins as well. There are a couple sub Slack channel six security events trash. Um, all those things um So those Are about specific things for example six security events is for cognitive security day and stuff like that There are a few that are not there right now. I will try and post it in such as, um, there's some um About the white paper spell. I think I'll update that But the slack channel was also a good resource and feel free to just ask questions and then You know, we'll try our best to help out and provide any clarification Thanks, Brandon. Maybe I had a question. I wanted to follow up on a comment that marked me. It's sorry I didn't follow the latter part of your argument Uh, you mentioned that there are these standards and there are some tools and those tools are not quite effective Or they don't work. Could you elaborate on that? Please? Sorry tk. Was that for me underwood? Yeah mark. This is Vinay here. Sorry. I I just wanted to Try to clarify your the latter part of your argument You mentioned something to the effect that that there are standards. There are tools But these tools are not quite effective which actually opens up another kind of a threat vector for Enterprises. Is that what you said? right, so The there are two artifacts released this last week by NIST There are other ones that I wasn't calling out in this in this particular meeting that are worth talking about in this context But I'm not I haven't listed them all there. I'm lazy, I guess But of the two that they offered up here, one of them is actually it's an installable executable And it tries to do a representation of a supply chain And what I my critique of that simply is Uh, it doesn't try to represent the semantic space or the technology space Of the kind of relationships between these nodes So a node that's a person and a node that is a third party application like say sales force, right a sass application or Our sap hosted internally on a you know internal cloud or Like a security tools another yet another example now typically those are cloud based So each one of these things if you represent them as a node Uh, they have a complicated type of dependencies or an ai world We would call these attributes or properties. So it's an unsophisticated uh graph representation, but Because there's nothing else better right now And because NIST is influential in this space It's a good place to start to get people thinking about it. So it kind of depends on the sophistication of the organization whether you can Lead people along a useful a fruitful path of Saying okay, this is you know a starting point now Maybe we can identify our risk register where we think our biggest threats are Our most unstable elements of our supply chain That could be people you just on boarded In a regulated business like the one where I work We're also worried about the ones where we get audited regularly Because even though the risks might be low We'd have to report out on a regular basis on those things. So that might be Elevated concerning if the risk is low So trying to do a better assessment of that graph then becomes a worthwhile enterprise But then a deeper dive Looks at things like threat models and how do you share information like intelligence that you might have You know in a fortune 500 organization or in a large government organization with people down your supply chain You know, do you Share it directly and just say we heard about this threat and here it is in oh fyi You might actually not be permitted to do that in your proprietary agreements with your contractors Because that they're selling that to you. You can't just give it away to someone else Also, you might have information where you don't want to tell them about your own vulnerabilities Right because you have uh information sharing restrictions. So there's a filter going on That's bi-directional and so Although you really want to automate alerting up and down the supply chain Realistically, that's not feasible in many settings. You need to You know, both have contractual and also automated Intermediaries think of these as agents in a kind of AI way these agents need to be Intermediaries between your principles of Sharing with the supply chain and vice versa So all of this is happening in a mix where we're all trying to automate things in order to be more efficient And deal with the deluge of alerts And traditionally there is no automated up and down chain alerting in information security. This is kind of a You know, you get on the phone with talk to some and talk to somebody or you get on slack and you tell them Hey, we heard about this bad actor and they might be going after you too Occasionally you might have sector-wide sharing like Utility sector or finance, you know, and they have their own interest groups, but that's not real time It tends to be, you know, periodic meetings and and that sort of thing. So that's the stuff I know about I know there's stuff that's dark sharing that goes on that's besides that but you know in the In the ethos of cloud native, you really want to have full transparency about supply chain Information sharing and vulnerability. So that's a longer version of this topic, which is a deep one Got it. Thank you so much. So It's a great framework, but Operationalization Is It's a very tall ask Well to that point and to underscore what you were saying, Mark, there is sharing that's going on But from what I've seen firsthand, that takes more of the approach of Hey, you know, you guys send your your sim alerts to my sim And there doesn't there's not a lot of structure to that. So having some sort of graphic or graph To, you know, what alerts am I sending you and what am I supposed to do with that on the receiving end? And how does that map to my, you know, ato or how does that map to my risk con one? I mean, I haven't seen anything That that specific or concrete that would help me operationalize What am I supposed to do with this this fire hoses of events that i'm getting from my vendors? Or that i'm asking my vendors to give me See that brings up a great point I mean, I don't know if we have time but maybe just one last comment on that is there is is there a There is no open standard right even all the threat data intel etc across so many different providers It's all proprietary. Is there like an open source or open standard rather for threat that can actually so you know Here is the format here's how it looks here's how I can ingest it and here is how I can operationalize it As anybody know of anything is that I don't know if it's the right, but is ogle xccdf I think maybe some of that I have to go refresh whether they have specific map There is actually as I recall mitre has some standards around threat intelligence information threat data I mean, there's the cbs There's the scoring mechanisms like cbs s3 cwe's stuff like that Where you have calculators But you're talking about the actual format of the information and how it's uh transferred correct. Yeah Yeah But it never really got hold i'm afraid i'm sorry, which standard It's an oasis standard for uh cyber ops interoperability that tries to do that but I think the current best hope for that is the The mitre universal ontology project and you know what they come out from that So that's a derivative of the other mitre projects, but they're trying to be a little more formal about it I I try to keep track of the standard where that is but it's not usable And none of the vendors are doing anything with it beyond trying to do attack mitre attack mapping I mean there is sticks right and that was the one that comes to my mind on the threat intel side I thought they had something for um the way you collect um specific uh Testing output. I i'm not finding it though Yeah, and you know the challenge is there's so many challenges with this, you know, do you trust information you get up and down the supply chain and You know, there's the reputation problem. There's the standardization problem and also The the nature of the threat depends on what you do as a business, right? So The supply chain threat for healthcare is not the same as the one you have for A finance business and even in finance. It's not the same between the the credit markets like credit card offerings and The the venture capital folks, right? It's uh, you know there They've got a big logging standard around what they're trying to do there that's got federal funding But uh, that turns out not to be very usable for somebody that that sells credit cards So there's a domain dependent part of this. That's that's important too I mean there is there is some open source things. I think we all know of that's the OW ASP, which is the application related security threats that there is a good log there And it's continuously being updated online community And I am just like my dad Okay, we got a 10 second gap of crickets. Is there anything else anyone else? Yeah, pardon. Would like to add or bring up? Yeah, if there was interest in this general topic, you know, I could try to put together, you know a more comprehensive Presentation and walk through that. Uh, you know, I really did do some more homework instead of this slap-dash presentation. I just laid on you I would be interested in seeing that Um, can I open a presentation issue and assign it to you? All right, thank you Yeah, we'll work on the dates tbd, right? Yeah Okay, in that point, I think we've covered all the major points and Gary went a good chance to I think I see one or two more people that weren't on the call initially So before you wrap things up if there's anyone that's joined partway through If you would like to introduce yourself Whether you're a new member or just getting to know sick security or an existing member Feel free to grab the mic now if you'd like to I see capill there. Would you like to grab the mic? I'm good All right In that case, that's a wrap for today. We'll see you everyone next week and until then stay healthy Cheers Thanks, buddy Thank you