Hi, welcome everyone to the Wednesday lunchtime seminar series, New Voices in Global Security. For those of you who don't know me, my name is Amanda Chisholm and I'm a senior lecturer at the School of Security Studies, the organizer and chair of this regular series. The series generally, the aims of it is to raise the voices and amplify the voices and expertise of our early career researchers across the school, as well as we have EDI cafe chats where we talk about various topics, a quality diversity and inclusion topics and interests to our students and academics across the school. So this in the spirit of an EDI chat, this is a collaboration today with WeWIP and it's on all about demystifying writing, academic writing particularly for people who, well anyone who struggles with the different types of writing academics are asked to perform themselves. So I'm so pleased to have WeWIP members here today. So we have Annie Garg and Annie right now is pursuing an MA in international relations. She earned her bachelor's degree in English literature and her growing interest in historical political mechanisms led her to pursue international relations, which allowed her to gain a more academic understanding of politics and power structures. As a result, she became intrigued by society's power and balances and stratification of discrimination. And at the moment, Annie is overjoyed to be at King's. Yay, Annie. We're grateful to have you here. Annie is a member of WeWIP team where she can put her passion for women's empowerment to work. And Annie also serves as one of WeWIP's blog editors this year. We're also joined by another WeWIP member, Aurora Pinnelli. And she's final year student in a double degree in European social and political studies between Saint Paul Paris and University College London. She spent her first two years focusing on Central and Eastern Europe where she majored in politics and government at UCL. She is majoring in philosophy in German. Aurora is also part of the Millennium Fellowship class 2021, a program part of the United Nations Academic Impact Initiative aiming at promoting social impact projects. And she's co-founder of the next chapter project taking place both in Palermo and in London and purporting the inclusion of young migrants in societies of first and second arrival. Fascinating work, both of you. You know, you're a testament to the amazing and brilliant scholarship and scholars that we attract here in war studies and at King's more broadly. So thank you for being here. For those of you who are unfamiliar with women and more in international politics, WeWIP, it's a network of women identifying gender queer, gender nonconforming and non-binary students, staff and alumni from across the faculty of social science and public policy at King's College London. The initiative seeks to support and increase the visibility of the peoples or persons rather working in the field of war studies and international politics, whether as students, researchers or practitioners and to showcase their work and their achievements. WeWIP also hopes to promote and encourage exploration of the question of gender and its implication in war, conflict, foreign policy and security practices. As such, WeWIP is a network for community building and event organizing. Again, so happy to have you here as part of the New Voices Seminar Series. Without further ado, actually, I'm now going to pass the floor over to Annie and Aurora, who will be chairs of this roundtable and will be introducing the speakers who have kindly agreed to share their expertise and insights into academic writing. So, Aurora and Annie, the floor is yours. Thank you so much for the lovely introduction. Let me start by introducing our panelist, Dr. Catherine Baker. She's a reader in 20th century history at the University of Hurl and has written or edited six academic books, most recently, Race and the Yugoslav Region, Post-Socialist, Post-Conflict, Post-Colonial and the edited volume, Making War on Bodies, Militarization, Aesthetics and Embodiment in International Politics. She often reviews proposals and typescripts for a number of UK, US and Canadian publishers, sits on three journals, editorial boards, and is a frequent peer reviewer for a wide range of journals, including Critical Military Studies, International Feminist Journal of Politics, Millennium and More. A very warm welcome to you, Dr. Catherine. Our next panelist is Lizzie Ellen. She's a communications manager for the School of Security Studies, King's College London. In this role, she manages public engagement and communication engagements, activities, including social media, media and PR, the website, events, podcasts, and videos across the school for studies and the Defence Studies Department. Prior to this, she held communication officer role in the Policy Institute, King's College London and at the University of Sheffield. Before working in higher education, Lizzie worked for Paul Bloomfield, MB. A very warm welcome to you. Thank you so much for this introduction, Annie. I'm going to pursue the introduction of the speakers now. So now I'm going to present Dr. Susan Martin. Dr. Martin is a senior lecturer in the World Studies Department of King's College London. In her work, she uses the international relations theory, particularly structural realism to analyze state policies on CBN weapons, deterrents and other types of coercive diplomacy and economic competition among states. Her work includes the articles The Future of Chemical Weapons, implications from the Syrian Civil War, with Joffrey Tempman and Hassan Abadmi. Norms military utility and the use, non-use of weapons, the case of anti-plant and irritant agents in the Vietnam War. The role of biological weapons in international politics, the real military revolution and the edited book Terrorism War or Disease Unrevealing in the Use of Biological Weapons with Annie Kluenan and Peter Lavoie. While continuing to work on the use of chemical weapons in Syria, she's also completing a book manuscript taboos or consequence, the role of normative and instrumental factors in US decision making on the use and non-use of chemical, biological and nuclear weapons in the Vietnam War. Amazing. Welcome, Dr. Martin. The next speaker that I'm going to present is Dr. Kiran Ful. Dr. Ful is a lecturer in international relations and the Department of World Studies of World Studies. Her research focuses on the politics of global knowledge production and the rise of data-driven practices like opinion pooling, which shapes how we understand and order the world. Having worked in both industry and academia, she has an experience of writing for different audience and navigating the rhetoric and expertise. Welcome, Dr. Ful. And then our last but not least speaker is Laura Zuber. Laura is a doctoral researcher at the World Studies Department at King's College London. She's investigating into the management of the COVID-19 pandemic in the UK from critical perspectives. Her research interests are global political economy, decoloniality, feminist theory, and crisis management. Laura has received a BA degree in media and communication from the University of Vassau, Germany, and double master degree in MA, European Studies at the University of Vassau, and MA, English Studies, Intercultural and Multilingual Communication at the University of Maga in Spain. Welcome, Laura. Thank you so much, all of you for being here. Your experience will be super inspiring. And I look forward to have this conversation. That's why we're going to start by discussing the first question that we have prepared for this conference. So what is academic writing for you? And how is it different from other jobs of writing you engage with? Who would like to start? Maybe Dr. Ful, since you have a lot of experiences in academic writing and other kinds of writing? Sure. Yeah, I'd start. Thanks so much, Aurora. Yeah, it's a good question. What is academic writing and how is it different from other forms of writing? I definitely see it as a very specific form of self expression and rhetoric and argumentation. And I'm glad that, Amanda, you described it as performing. And I really do feel like academic writing is a bit of a performance. I think it has its own language and its own formalities and its own tone. But these things are always changing. They're always being renegotiated or broken down and built back up. I think academic writing is is always like intention because it tries to be clear and concise, but it's often obscure and very complex and wordy and can be inaccessible. But it sits within that tension because I think what I find is that it helps me sometimes, sometimes to dig deeper into ideas, right? I find the more that I read and write in the academic setting, the more I can understand or navigate complex ideas and complex terms. And I think that can be helpful sometimes for making sense of things. But I think I guess because it's a tension between these things, I find it both very constraining, but also freeing compared to other genres, both. I think if I compare it to like strategic writing, strategic documents and reports, it's both more constraining and more freeing, but in different ways. I certainly wouldn't call it my natural voice, that's for sure. Yeah. Thank you so much for your answer. It is very interesting to understand how academic writing can be constraining and freeing at the same time. Does anyone else have some insights to add at what Dr. Ful mentioned? Yeah. Yeah, so I mean, I guess, for me, the central aim of sorry, for me, the central aim of academic writing is to make an argument, right? To answer a question or to solve a puzzle. And to do this effectively, you need a knowledge base. So you need good research where you're asking useful questions and gathering the best available evidence and critical thoughts. You really need to question and engage with your sources, but also with your own ideas. And I think it's, it's really important to realize that academic writing can't be separated from research. It's your analysis of your research that gives you something to say. And it's through that analysis that you develop and build the argument that you're trying to present in your writing. So one of the things I always stress, and which I always come back to in my own work is that research and writing are not separate activities, they're not sequential, where you first do your research and then you do your writing. But instead, writing is part of the analytic process. It's only when you get to when it's only when you start to try to put the words down on paper that you really start to process your research, you really start to think your ideas through. And as you do that, you develop new ideas, new questions, all of which lead you back to further research. Thank you so much, Dr. Martin, Martin, for your, your detailed explanation of how the role of research in developing puzzles and questions to answer. Dr. Baker, would you like to go next? Yeah, I love that we're all having such different answers to this question. And you know, that kind of silence there first was when, you know, you're asking us what is academic writing, and we all do so much of it. And none of us seem to immediately know what it is. And I think for me, one of the one of the first things I'd say it is, is, you know, academic writing is writing that has citations. It's accountable to where it got its sources from. And, you know, that's the case in terms of how integral it's linked to research. And we need to be able to, you know, show what we did and explain our methods, our positionality well enough that other people know if they can trust us or not.   But, you know, for me, all of that's important to, you know, build into academic writing.  You know, I write a lot about post-Eucharist Arab region, I'm not from there in any, you know, in any sort of shape or form. So, you know, within that unequal politics of knowledge production, but unfortunately we're in and, you know, we need to be to be fighting against, you know, their two citation is all the more important. A lot of the rest of academic writing in terms of formats, you know, we could say is, you know, tradition or convention or gatekeeping or, you know, maybe even empire, if we're going to put it that way. And, you know, that is, you know, I think where it's so powerful when, you know, authors find ways to break those molds and still be able to get across the intellectual accountability and the complexity that, you know, really great academic writing might hold more space for than any other form.  You know, Anna Akafanglu and LHM Ling's amazing book Transforming World Politics because of the way in which they managed to, you know, cut through all of the kind of conventions and the coloniality of, you know, formal academic writing in international relations and, you know, envision something that's, you know, much more intellectually expansive and hopefully emancipatory as a result. Thank you, Tobaker. Absolutely. Like, sources are crucial in order to make, to make academics accountable for their work, for their rights. And it is also related to what Dr. Martin was saying about the importance of research. So, Liti, would you like to add on this? Yeah, I mean, I guess I would, obviously, I'm coming at it from slightly different point of view, because I'm not an academic and I don't write in an academic way. In fact, I'm often sort of rallying against academics when they're writing for public audiences to tone down the academic ease in their prose. But kind of building on, I guess I would agree with Susan to an extent in that, you know, I think ultimately it's about communicating messages, it's about communicating research findings, which might be answering question, or providing more information or a new interpretation or a new analysis on an issue. And I think, you know, briefly, academics have a real space in public fears. Essentially, we obviously with the terrible war in Ukraine, it has generated a huge amount of interest in war security issues conflict. And we're getting a huge number of media requests coming to water these here for our experts to speak about these things and write about these things more importantly. And so, you know, journalists, commentators, politicians, they all rely on academics to fill that space of presenting, you know, in depth, in analysis, in depth, information, in depth, thoughts about situations that they can bring to the table that no one else has had time to do or time to look at. And they also, hopefully still in this day and age, people treat academics or expert's opinions with respect and feel that they are entrusted for. So they're really important to journalists and politicians who, you know, the public don't really trust as much. And so that's a really key and important part of academic writing. And I think it's something that, you know, people don't always, it's not always easy because you learn to write as an academic you, you know, train over so many years to write in this very dense and wordy and slightly esoteric way. And when it comes to communicating with public audiences, you have to turn all of that and strip all of that back and completely change reverse the way in which you write. So I think it's interesting at the heart of this is there's a kind of clash between, you know, the message and the wanting to communicate research findings and the tone and the register that you're using and the language that you're using to communicate those findings is, you know, often impenetrable and inaccessible for most audiences. But that's, you know, I'm not criticising that because obviously it's important to write in that in that way. I think it's just about just emphasising the need for us to for academics to be able to learn to write in more accessible ways as well and obviously work with our comms team and hopefully to do that because that's our job as well. Thank you so much, Lizzie. Laura, would you like to add on that? Yeah, thanks so much, Laura. Well, I think that I think that my response to the question would speak more to the members in the audience who may be new to the university and just started their studies. But I think, and I hope that everybody can take a little bit from it. So I think that, you know, what writing academically means has evolved a lot because I think that what academic knowledge for me means has evolved a lot alongside it. So firstly, when I was actually entering university and, you know, took my first academic books to hand, I thought that academia, and please don't judge me because that was a really long time ago and I was kind of naive. It was just about producing information, you know, plain and simple. And that, you know, that information would be produced in academia according to fixed rules and it would be neutral and mostly true. And that should be academic knowledge. So I had a very narrow image about it. And in terms of academic writing, you know, whenever I wrote something that, whenever I read something that was inaccessible and, you know, full with jargon that I didn't understand, that was a signal for me that it was good academic writing. So everything I didn't quite understand sounded very smart. So there was a little bit of imposter syndrome in that, you know. And so today, yeah, it's obviously I think that it's less about producing information plain and simple, just for the sake of it. But more, you know, I can echo Dr. Martin, it is about reflection, it is about developing your arguments. You know, now I'm thinking about academic writing in kind of an art of expressing your thoughts and your your your reflection as a journey as, you know, accessibly and concisely and precisely as possible. I needed to share that reflection with the readers in a yeah, in an accessible way. Say, by like, you know, and I think that that is what is for me academic writing. But also through engaging especially within a feminist and critical theories. My idea has also significantly broadened, you know, now I think that, you know, using the first person or also there are so many more experiential academic genres, like, you know, pumps, for instance, that's also part of it for me. So I guess that in my academic writing, when I think about it today, what I can say about it is that a lot of people have appeared of it in it. So I have appeared as the first person and the reader has appeared. And obviously, all the authors that I'm drawing on in my literature have appeared. And nowadays, I like to think about academic writing more as a conversation. Because I think that academic knowledge is a relational and a communal project.  So yeah, I think that it's really fascinating to hear all the replies and how different they are. I think that, for me, the answer to what academic writing is and how this should be done, I think that depends a lot on our, you know, idea on what on what constitutes academic knowledge. Yeah. Thank you so much, Laura. This question was super insightful. We had an understanding of the importance of academic writing in relation to research, to sources. At the same time, academic writing as a way to free himself for himself. And also the role of academic writing in politics and the understanding of the words from the authorises. So it was very, very interesting. And that's why now we're going to I think the next question is going to be it's going to add on the conversation we've just had. And I'm leaving the floor to Annie to start discussing the next question. Thank you so much, Aurora. And it was lovely to hear about what academic writing is. Now to take this conversation a little further, I want to focus upon writer's block. Like while we're writing academic writing, there's always a stuck of thoughts where we feel very difficult to move forward. So my question on the floor is like, have you ever experienced writer's block? If yes, what was it like for you? And can you give us a tip on how to deal with it? If not writer's block, are there any other challenges relevant for you that you would like to talk about? Maybe Dr. Martin, would you like to Sure. So I'm not sure I've had what I think of as writer's block, which is sitting down at the computer and having nothing to say. But there are certainly lots of other obstacles to writing, many of which I experience on a daily or weekly or an hourly basis. One is making time to write and staying focused during that time. And I think one of the things that we started doing in war studies under Amanda's tutelage is setting aside actual focus time for writing, writing in 45 minutes sprints.  And that helps. But there are lots of different kinds of tricks and tips here. And I think it just, you just have to find what works for you. And you have to remember that what works one day won't necessarily work the next. So you need a whole bag of tricks so that you can try different things when you're stuck. I think the other thing is that as I was saying before, it's actually the process of trying to write where you figure out what you're trying to say. So if you don't know what you're gonna say and you feel stuck because you don't know what you want to say, you just have to start trying to put the words on the paper. The flip side of that is that sometimes, you know, one of the best parts of academic research and writing is you have that light bulb moment where you have this really great idea, right? And you're really excited about that idea. But getting, I mean, but then there's the real work begins, which is getting that on paper. And that can be a real slog, right? It can be really hard to try to force those words out to communicate that great idea that you've had. And that's just the slog that is involved in any sort of writing, I think it's the hard work. And you just have to the only way to get through it is to do it. So I'll stop there and let other people chip in. Well, I think that it's a wonderful advice to sit there for like 45 minutes straight and then write because it's going to be like the whole thoughts would be there for whole 45 minutes. Anybody here would like to add more to this? Yes. Gatsby. Yeah, I mean, I used to be in a position where, you know, very fortunately, I could have said it's not really something I had to cope with. But, you know, it is something I'm having to cope with now and possibly finding it more difficult, because I've got this file without it having been that much of a problem so far. But, you know, essentially, I've, you know, for a lot of different reasons, lost a lot of the kinds of sources of identity and energy that, you know, used to make me feel like I've got a place to speak from and that people would be interested and that I would feel safe in doing that. So, you know, that just kind of raises the stakes of everything I need to be doing, at the same time as the actual immersive time that I'm able to get for, you know, getting writing done or even that kind of initial thinking process, you know, is also for various reasons, a lot more constrained than it was. And I mean, I don't know if I'm dealing with it particularly well compared to, you know, maybe people for whom it's always been a struggle. I think one of the, one of the things I have kind of managed to do is I have to catch a point where my feelings about disappointing someone actually become worse than my feelings about doing work.  And, you know, that was the most difficult thing I've had to get into recently by any means compared to some of them.   And, okay, well, who am I writing this for? Who would it benefit? You know, that probably when I started out was, you know, or for so I hadn't met yet, but my work was in conversation with, you know, now it might well actually be people I know. So, you know, when I was writing this particular piece, and it was on contingent whiteness in central and eastern Europe, you know, as well as the fact that, you know, if I don't do this, what we had to think, you know, I was also very conscious that, you know, these are things which Amanda and I have talked about, for instance, I thought, okay, well, I want to write this so that, you know, Amanda can actually cite it in something which she's doing. And, you know, then the conversation goes on. So, yeah, I think maybe the way that I've been trying to get through writer's block is, you know, just kind of narrowing down and personalising my sense of, you know, what am I doing? Who am I writing this for? And maybe that kind of helps me find the mutuality that we want there to be in, you know, good and meaningful academic writing, I hope so. But, you know, I am probably not the person who is dealing with writer's block best of elements. I think that was also very lovely advice. Lizzie, would you like to add something to this? Yeah, I mean, I'd say, obviously I'm not writing lengthy academic texts, you know, I haven't written anything for a long since my 600k dissertation at university. But I'm having to write very short, concise focus pieces where I'm disseminating people's work on issues. And that can be a challenge in itself to sort of condense things down and cut down on detail. But, you know, whenever I get started on something, it's whenever I have to do any writing it's always just hanging over me as a cloud. And I find that you can't force yourself to do it if you're not in the right frame of mind. So for me, I always make sure that I set aside, you know, rather than having a focus for 45 minutes, I prefer to have a good kind of morning or afternoon where I can just get completely into it and not have to think about anything else. And I can turn emails off and that kind of thing. And I tend to do it on a day I know that I'm going to be more productive. So not on Monday and not on Friday. So not working against yourself but working with yourself and knowing when you're going to be more likely to work productively. But the biggest thing I'd say is, you know, I think we're held back a lot of the time from this kind of perfectionism and the fear of failure. That when we start writing, we don't know how to say things, you know, we'll get lost, we'll do a rubbish version. And I'd say the first time that you write a draft, then it probably will be rubbish because ultimately writing isn't just about the first go, it's about refining, the editing down, changing structure, that sort of thing, working through several versions.  And you might do a really poor first attempt, but it'll be on this, you know, second version or the third version, it already starts to refine your language and the points that you're making. And you'll start to turn it into something that you feel proud of. And that I guess would be my main tip when it comes to writing for Rock. Yes, I think like, as Dr. Martin said that the first thing it is to sit down and do it. I think that that really works. Thank you, Lizzie. Lauren, Laura, Laura, would you like to add to this? I guess I I mean, I think I did, I did experience writer's block a couple of times. If you know, if you mean by writer's block, you know, just just sitting in front of the screen and just tearing at the screen for for hours and just not really be able to bring anything to paper. So I think, yeah, I definitely have experienced that in my life. And actually, when I did say it had to do with mainly three things. And the first things was that first thing was actually easiest to deal with. So that's when, you know, maybe maybe you have your insecure about your writing style, that was especially the case when I started in university. So, yeah, I think that, you know, when you're insecure about your writing style and feel that that that's why you cannot buy you have a writer's block, you know, as well, it's just practice, just going writing and also there are great workshops, actually, by the college that that has that have helped me to build a confidence in my writing style. And so the second thing was when it's not about your writing style, but you really you feel like you cannot really say much about your topic, right? There is also again, a little bit of imposter syndrome in there. And, you know, I think that once you have read two or three papers or five, you are able to write to start writing on them and just make a first draft. And, you know, you can revisit that draft. That is actually something I think I even heard that suggestion in in one of the workshops I visited. And, yeah, by coming back to the draft, you can just go on reading, reading more broadly. So that's, yeah, that's when kind of academic writing really is, you know, it's a it's a it's a it's a work in progress. And, yeah, the third, the third course, while by I ruffled with with writers block sometimes had either to do with my writing style nor, you know, my confidence about having something to stay. But it was more had to do with, you know, what's going on backstage in your life. Right. I think that most of us have at some point in their lives grappled with anxiety, feeling, you know, just insecurity. And a lot of problems just, you know, for instance, maybe going through grief and loss and, you know, all the bad things that, you know, that can happen to you backstage, that can happen between the lines, literally. And say, it is very, very difficult to say, you know, anything about how to remedy that. In my experience, what has helped is obviously, working twice changing the circumstances, that that may be that may be feel unwell and unbad. And that's obviously a process that that can take a it's strenuous and it can take a long, a long time. And yeah, on the on the short term, what has what has always helped me was just to make kind of an inventory of everything I'm happy about everything that is going well. And to just kind of hold on to that, you know, be be the family member or community or whatever it can be. And just, you know, tap more into your sources of faith and energy. And that mostly always, you know, helped me to to overcome writer's block and, you know, when it was more most acute. Yeah, but I think that writer's block and how to overcome it, I think it depends on on what causes it, right? And it's, first of all, you know, difficult to actually figure out why why you have a writer writer writer's block and then it's depending on the cause, it might be also very difficult to overcome. But well, just to give a little bit of hope, I have so far always managed to overcome it. So, yeah. Thank you for your lovely insights, Laura. Kieran, would you like to add something? Sure. So I don't know, maybe a bit candidly, I can say, I think I suffer from a minor form of writer's block all the time. But it has to do with the way I think that I write and also it links to often confidence, how confident you're feeling in your ideas, like what Laura's saying around anxiety and imposter syndrome, things like that. But what I've noticed, like I pay attention to sort of what what writing makes me feel at different points through the writing process. For me, the hardest part is usually getting started on something new. It's like the blank page that is the most daunting. And I think that's when it usually hits. And it's because for me, I tend, I write in a probably to my detriment, I don't tend to be a draft writer. I don't find it helpful to draft something and come back to it later, because I find I change my mind completely and I don't like it. I tear it up. So I have to be very kind of OK and at peace with what I'm about to do. And then I write something, sort of start to finish, look at it and see how I feel. And that's a bit strange. But I don't know, it's just how I train to write. What helps me to overcome it is firstly knowing when when I face a blank page, I that like what's happening there, that kind of relationship, what's going on between me and writing and to also do things, I create an outline, always relying on outlines of what I'm about to to say or draft or structures. I have lots of pieces of papers and whiteboards where I write things as an outline just to help myself get started. And sometimes I don't know even if I'm like walking or on the tube and then idea comes to me about what I could write or how I could write. I jot that down on my phones or write it down. So I don't forget. But I think maybe to link back to something that Catherine said, I always find that especially when it's tied to your career or your academics, writing tends to be for something and someone I don't always feel like when I'm writing in this academic way that it's for me as much as it is for something an audience out there. And I think that navigating that probably better than I do would help to ease with the writer's block or or the fear of getting started. Thank you, Kiran. It was lovely to hear a thing. I think I think most of our participants here would be feeling the same kind of a blockage while writing it. And thank you so much. I want to leave the floor open to Aurora. Yeah, thank you. And thank you, everyone for all your insights and the way you fight blockage. But at the same time, how you managed to keep the confidence and to navigate this. Yeah, your challenges and talking about challenges before moving on in the Q&A, one of the questions that we wanted to ask as we are also members of VIVIP is like in your experience, do you think that gender matters in fighting in finding your academic voice? So while we talk about challenges in general, but what's the role of gender in the challenges and the you that you face and how contributes to you finding your academic voice? So Laura, would you like to start? Yeah, I can say a little bit on that, but I was also wondering if maybe maybe it would make sense to leave that for after the Q&A. I don't know. Maybe the audience would like to chime in with some questions. It's how you prepare, really. Yeah, sure. We can also start with with the Q&A. So we had a question for Lidzi. So discussing the style, the the academic style when writing for nonacademic audience, how do you suggest academic tone down the writing style to make content more accessible to wider audience from Clara? I don't know if Lidzi can reply. Otherwise. Otherwise, if anyone else has a question and the Q&A, you can also either write in the chat or jump in. So it seems like maybe we have to leave a little bit of time to the audience to write their questions. Or if any of you would like to start by talking about the role of gender in your academic, in your challenges, that you find in your job. Or Lidzi, there was a question for you. Would you like to answer? Yeah, I was just completely distracted by something going across in the water and maybe not things that are right. But yeah, what was it? Sorry. No problem. Your question was a question from Clara saying when writing for nonacademic audience, how do you suggest academic tone down the writing style to make content more accessible to wider audiences? I guess the one thing that you learn often when you're writing for the media is the sort of pub conversation trick. So if you were talking to your friends in the pub and you didn't want to bore them for hours and hours and hours by talking about your academic research, how would you condense what you're working on or what you want to communicate, a paper or a general article or something into a pissy phrase or something that you would then use to explain to your friends or your mum or something. And that's where you start because that's your main argument. So when it comes to communicating, if you're doing press release, for example, and also a common piece to some extent as well is you front load the information to start with the core argument, you don't build up to it. So academic writing, you'd normally do a long preamble and you'd sort of give all the context, the background, and then you wouldn't really get to the main points until, you know, the second half of whatever you're writing, generally the conclusion towards the end. So it's the opposite of that. Basically, you're going straight in and saying, this is what I've found out, or this is what I think about something. And then you're providing the evidence and the context to back that up afterwards. And I'd say, you know, depending on whatever it is you're communicating, you know, you want to be you want to have that one main argument and then you have three or four key points, evidence, back up as well, that you bring to illustrate that point. But yeah, I mean, if you do some guides and things, if anyone's ever wanting to work on anything like this, we do support the work of PGRs, ECR, early career researchers. Sometimes they may students right for this as well. So we do help support with editing and everything. Thank you so much, let's see, for your insights about how to to like, create a language that is easier to understand for everyone when writing academic style. So if anyone else has a question, you can either write, Clara is thanking you. So you can either write in the chat or or you can also talk, we can give you the the floor. So yeah, feel free to ask the whatever question you would have. Seems like oh, yeah. Okay, perfect. Zuzia, Zuzia, he's asking, how do you all try and maintain a truthfulness in your writing? My difficulty when writing is continuing to question my stance when I'm already quite entrenched in the writing and not failing back on an answer that comes too easily. Does anyone have methods to reengage questioning later on in the process? So who is there anyone that has particular insights or maybe okay, Dr Baker, the floor is yours. Yeah, just seeing that question, I think maybe one thing you could try is externalizing it a little bit. So, you know, I mean, if I want to open up a critical perspective in something I'm writing, one thing that I might do is think, okay, well, what would so and so think? And, you know, so and so is an author from a different approach and the discipline or a different discipline altogether, or, you know, somebody I know would take a more critical or even oppositional stance towards the thing that I'm arguing. And, you know, so then how would I satisfy that person and that objection that they might have in that argument? So, you know, it would be less about, you know, me needing to come back in and questioning question it, you know, more making the move of, okay, well, how do I outsource that questioning to, you know, this imagined other person and then resolve that within the item? Thank you, Dr. Baker. Um, yeah, go Dr. Martin. Yeah, I mean, another simple trick I think is just to put it away for a little bit. So to take a break from it so that you can come back to it with fresh eyes. Um, I mean, I think, I think sometimes we're aware the weaknesses of our argument more than our readers will ever be, right? Because we spent so long thinking about it. Um, and in some sense, it's trying to, I think, uh, Catherine's advice about, you know, what are the main counterarguments that somebody else would make helps to focus us on the, on the important weaknesses that we can address. Um, but I think it's important to at least acknowledge, you know, the weaknesses that we see as well as that other people will see. You can't necessarily solve everything, but if you're at least honest about what weaknesses are there and what might be done in the future to address those gaps, that's another way of engaging critically with your argument. Thank you so much, Dr. Martin. Uh, Laura, the floor is yours if you want to add on what Dr. Baker and Dr. Martin have already said. Uh, you're muted. Sorry. Um, yeah, I don't know how much I can add to that, but, um, say it happened to me in my PhD process that I'm kind of changing or rephrasing my question, right? And that is precisely because, you know, I'm, I'm engaging more and more with, with, with the literature for my thesis. And I think that's natural. I think that's just a natural process. Um, and, um, you know, I think that your, um, your question refers to, you know, what, what, what if I change my question? Um, you know, the night, you know, if I, if I change my question in a later phase, I have to rewrite the whole thing, uh, but, but you don't have to. First of all, um, it's always good to be honest. Um, it's good, you know, to communicate to Rita while, um, you know, that, that question, my question that I'm grappling with, that I aim to solve, um, and answer, um, or discuss in these, uh, you know, um, thesis or, um, or dissertation, um, has evolved and then just, just tell a little bit about, about your story, about the journey and then, um, you don't need to rewrite everything. Um, you know, you're, you're still, you know, the question that has evolved from your first one is still, still in the same topic, right? It's, uh, it's not like you, you just ask something like completely different. Um, so you can use, I think mostly, much more than you think from what you have already previously written, um, and thought, and thought about. So, um, I think that, um, that's just, you know, questioning your stance and questioning, questioning your question, um, uh, is not just a natural process, but it's also a good thing.  Um, so yeah, I, it's always, it's always best, you know, if you have a question in the beginning, um, and then that's how, that's what it stays. Um, and that question you just answer in the end. I mean, that, that makes things say, well, say much easier for you, right? Uh, but, um, it's, it's, it's not a bad thing, you know, to, to be critical also with, with yourself and with the perspective that you have entered into your research. Um, so yeah, I then, I think don't worry about that too much. Thank you for Laura for framing these challenges as, uh, a source of, uh, development. Um, and so if we still have time for at least one more question. So if anyone else would like to ask something else, you can even jumping or write your questions in the chat. Um, or if anything, anyone else has something to add, um, for the question you could also jump in. Um, so other, yeah, Dr. Martin. No. So just quickly on, on, I had a couple of thoughts on, on the gender question, which are sort of tying to think other things people were saying earlier. Um, so I'm not sure how much this is about gender, but I think it's related. One is that, I mean, finding your academic voice, good academic writing takes practice, right? And some people will show up to university and have had lots of practice in secondary school doing this sort of work. And some people won't.  So that, that learning curve is constant. And so I guess just stick with it, I guess would be one piece of advice, right? And take the opportunities for practice, seek out opportunities for practice. The other thing is that I think this came up in the discussion of writing in of writing block is that academic writing is authoritative writing, right? When you present an academic argument, you're making a claim to being an authority on the subject that you're writing about, as well as acclaimed the value of your thoughts and arguments on that subject. And that's where imposter syndrome comes in, that's where self confidence or a lack of self confidence can really undermine us. And I think not all of us grow up in an environment where the value of our views on the world is affirmed, where we're encouraged to question existing arguments, and where we get practice constructing our own arguments. And again, you just have to be comfortable doing that. And I mean, you can see it. I mean, so, you know, one easy way to see this, right, is when you're looking at an essay and the number of times you're quoting, as opposed to the number of times when you're putting things into your own words. And it's that that confidence of being able to paraphrase and being able to express your own thoughts on the subject instead of just relying on what other people have said, that that is a crucial step in developing your academic voice. Thank you so much, Dr. Martin, Dr. Baker, sorry, the floor is yours. Yeah, I mean, really just to back up what what Susan said about the, you know, how gendered or, you know, how gendered this question of authority is.   There is, you know, you could see it in other ways as well. But in terms of, you know, what has created the hierarchies of, you know, what counts as unquestioned authority and, you know, where have people still got to try and feel, feel like, feel like they're breaking in, you know, that history is there.  So, you know, clear, clearly, of course, we've got to take race as just as constituted there.  But, you know, all of those then, you know, affect what platform we even believe we have when we start writing, you know, on top of, you know, then how do other people react to our claims to a party because of the, you know, because of the embodied selves that we each bring to make that claim. Thank you so much, Dr. Baker, Baker, the third full, would you like to go? And just make one small point to link back to citations and how so much of academic writing is about this conversation with others who write in the field or have written. The point is that also so much of what we read shapes our academic voice, sometimes in ways without us even really realizing it. And so reading, reading and what we read tells us a lot about what we and how we write. And so like as, you know, one example when I was growing up, I went through a small phase where I was sort of obsessed with English literature, classical literature, which is mostly written by a dead man. And I would often read it in their voice. And I thinking through the fiction and nonfiction that I read growing up, a lot of it was in it was written by men and I was reading it in their voice. Now, the more we read and the more broadly we read across different voices, that will again shape our writing in such implicit ways, but also open up our our mind to. Yeah, I mean, I think it's just a very important thing to to reflect on what we read as we reflect on how we write. Thanks. No, yeah, absolutely. Absolutely. Like listening different voices for sure, like shapes the perspective, the perspectives and the way these perspectives are also expressed in the first place. Maybe Laura, you would, we have, we don't have and a lot of time left. So if you have like final remarks that you would like to give. Otherwise, I will thank you all for your participation and for your insights and for having given to all our audience of your perspective on challenges not on academic of academic writing, but at the same time, it's like the creativity and how like intellectually stimulating academic writing is. It was a pleasure to be here. Also, thank you for giving us opportunity to moderate this conversation. And yeah, and I hope all of you will have a beautiful day. And thank you, Kiran, Katrin, Annie, Laura, Susan, Amanda, and it's for being there from being here today. So yeah, I think I hope you enjoyed this conversation as much as I did. And yeah, I'll see you soon in the next event. Thanks, everyone. Thank you. Bye. Thank you.


Hi everyone, this is Dave Vellante of Wikibon, and I want to talk to you today about Storage Summit. Storage Summit is a 12-city road show that we're doing sponsored by Oracle. I'm very excited about Storage Summit because it affords me an opportunity to meet with infrastructure practitioners all over North America, from Atlanta to Calgary to New York, San Diego, and a number of cities in between. As part of Storage Summit, I'm also hosting several crowd chats with my partner John Furrier. Crowd chats are a tweet chat application that we use to engage audiences and share ideas. You can check out crowdchat.net-slash-storage-summit to see what we've been up to on social media. There have been some great conversations that pivot off of the road show that we're doing. The great thing about crowd chats is their threaded conversation, so it's easy to follow along. Unlike tweet chats, the conversations are automatically transcripted so you can go back and experience the discussion long after it's over. Now, I want to talk to you a little bit about Storage Summit. I've been an analyst in the IT business for several decades now, and I can't remember when I've seen such huge disruptions coming from so many different directions. At the highest level, I've been talking to customers on the road show about cloud, mobile, social, and of course, big data, and what those mean for you and in the future. But we're also drilling down into some detailed research findings from various studies that we've done here at Wikibon. Now, if you don't know Wikibon, we're a research community comprising 18,000 IT pros, and everything we do is open and freely available on our Wiki. Our research is written for and often by business technology practitioners. And to maintain our independence, we have a very strict policy that our sponsors don't get to see the research notes until they hit the Wiki. Now, when we do research at Wikibon, we heavily rely on feedback from practitioners to develop our findings. We build economic models and test them with real users. We don't just take what a vendor says at face value. Rather, we dig, we confirm, challenge, report back to our audience our findings and our recommendations. So on the storage summit road show, I'm unveiling some fresh research specifically related to flash and also archiving. On the flash front, we'll take a deep dive into flash first hybrid architectures and compare them to other approaches like flash cash and all flash arrays. Where do flash first architectures make sense? Which use cases will excel? What are the cost tradeoffs involved? How and how fast should you think about moving to flash? Now, on the archiving side, we look at flash and its impact on traditional spinning disk and, believe it or not, tape. Yes, tape. Tape is making a comeback because the costs are so compelling and in the right use cases, performance can actually be better than disk. Really, you ask? Yes, really. And if you come to the storage summit, I'll explain why and suggest ways you can cut costs and deliver more value to your organization. So look for a storage summit road show in your city and check out crowdchat.net slash storage summit to see the latest action on social. This is Dave Vellante of Wikibon.org and we'll see you next time.


Kings of the Wild except it's spelled with a Y because it's like cool and edgy and stuff This is the introduction song. It's not very good, but it's not too long Okay, so Kings of the Wild this one has been requested a lot recently and Actually going back a while. It's been requested a lot But anyways the point is this one I really liked, you know It's not a traditional epic fantasy the way I was thinking it might have been and it's not really a traditional heroic fantasy either it is for the most part a pretty light-hearted story about Some dudes who have already gone on a lot of adventures and this is sort of their last hurrah and While there is some stuff, especially in the latter part of the book that is all about like, you know Saving the world saving this city and all that it is for the most part pretty light-hearted and pretty funny and Well just fun so the story follows this guy named clay or it mostly follows clay at least and He is an old retired mercenary He used to be part of this mercenary band called Saga and it was him and four other dudes and What mercenaries do in this world is they usually like go off into this big wilderness called the Heart Wild Which is full of monsters, you know goblins and ogres and Cyclops trolls like all sorts of stuff that you can imagine and They go in and clear out troublesome spots in there and You know saga was this big famous very successful mercenary band and about 20 years before the story starts They broke up and now clay is just a guard in a small town, you know, he's married has a daughter keeps in Somewhat contact with some of his old bandmates, but not that many and when the story starts this one named Gabriel who is One that he actually does still keep contact with comes up to him and he basically says hey my daughter's in a lot of trouble She could die soon. If I don't go save her. I need your guys's help and Eventually clay agrees to it. He's kind of reluctant at first, but in the end he's like well I can't Leave you and your daughter hanging so I'll go and then the story unfolds from there they get the rest of the band back together and then they go have to cross the heart wild and go to the city that's under siege in order to rescue his daughter and Yeah, it's it's a pretty simple story overall Now the best part of the story is just how fun and lighthearted it is Like there are a lot of little jokes not only in the narration but also in the characters talking to one another and you really do get the feeling that for these guys a Lot of what they do is banal like to us seeing A bunch of mercenaries cut through like a horde of goblins or something that should be exciting or cool But to them it's just like yeah, we've done this sort of thing a million times And even though they're kind of old and you know in a lot of cases fat out of shape Like they're in their late 40s early 50s at this point. So, you know, they they're they're getting they're getting up there in age But you know, even though they're kind of out of shape and they're not fighting as well as they could have 20 years earlier they're still Not that intimidated by a lot of this I guess that's the best way of putting it and that is pretty funny And then they also make jokes about stuff like how clay had sex with mermaids and stuff like, you know just little things like that spread throughout are genuinely really funny and really great and then as Clay and Gabriel start gathering up more members of the band they Each of them has their own issues that they're dealing with that they need to help out with real quick before they can go off on their adventure and then the adventure itself is I'd say it's about half the book because like the first half is just getting everyone together and the second half is Going off and doing it. What I will say is that the second half of the book is a little bit weaker because while the first half does introduce a villain actually more than one villain really and it does Sort of hint at okay. Yeah, there's bigger forces at play. There's gonna be More stuff going on. It's not a simple battle that we're going into It also feels like that's kind of a sideshow and the main story is still just these couple of guys trying to say it one person and Then the second half it brings all that political war stuff into the forefront and While it's not complicated or anything.  I guess is the way I should put it like the second half feels more like a regular epic fantasy and While it's done. Well, don't get me wrong. It's not bad by any means. I was never bored or anything I do wish that it had stayed with the totally lighthearted fun tone Because the first half you're not really supposed to take it all that seriously and even in the second half There's still jokes and stuff like they repeatedly refer to Getting all the mercenaries together as getting the band back together And then there's a chapter near the end of the book That's literally called the battle of the bands like the author knew what he was doing, you know It's a pretty silly book for the most part and I just wish it had stayed that way But again, the dark bits aren't bad You know, there is a the backstory of the main villain last leaf is Genuinely pretty great. I haven't seen anything like that before but it's also really twisted and Had that been in a book that was just more dark overall Then I think it would have been fantastic as it is here It's still good, but it feels just a little out of place as for other stuff I should complain about um, I think there are a few too many characters in this like I mean, it's a basically a heroic fantasy at the end of the day Which means you should just focus on this small cast and all the main characters are great by the way Like all the mercenaries clay and Gabriel are kind of the straight men like they're pretty normal And so at the beginning of the book you might be thinking okay The rest of the characters aren't gonna stand out that much, but no they do They're they're all kind of weird and unusual in their own ways, which is which is great But yeah beyond the mercenary band There are a lot of other characters some of whom stand out and a lot of whom don't and so after a while when it starts Introducing new people they kind of just blend together as oh, this is one of saga's old friends And this is also one of saga's old friends and this is also one of saga's old friends And then this is somebody who's after them for this reason and this is somebody who hates them for this reason And so there are just a few too many particularly with the villains because I think if they were gonna have Like they basically have three main villains or hell you could say four main villains in this book and I think Two or three of them could have just been combined together But you know, it's not a big deal I'm really just looking for things to complain about at this point and I will say that while the climax is really good You know, it's this big battle. It's a whole lot of fun. There's crazy stuff happening They're killing monsters killing people all sorts of neat crazy stuff And it does end in a way where it's like, okay I know there are sequels to this but you don't have to read them like this wraps up the story very well And I'm actually not sure what they do with the sequels It might be like a generational sequel where it's just their kids going off doing stuff. I don't know but anyways It ends that way, which is great But then there's an epilogue and the epilogue is honestly kind of depressing like I feel this book Either should have just left the epilogue out and ended on a little bit of a higher note or It should have rewritten the epilogue so it was a little less well Sad honestly Like I get that a big part of this book is that their heyday is over and they have to step aside Let the young ins come in and do their thing while saga just enjoys retirement and Enjoys the rest of their lives, but at the same time it just I Don't know it left me Leaving the book on the downer note rather than a happy one But despite all the complaining I was just doing this really is a fantastic book like Absolutely phenomenal like one of the best ones I've read in a while or I guess technically not read because I got this as an audio book But whatever it is fantastic. It is funny.  It has one really good villain and Even though it gets a little too deep into the epic fantasy saving the world type stuff That was done fairly well and for the most part the focus was kept small it was kept on just this one group of characters trying to save one person and in the end Yeah, I would recommend this to fans of pretty much all types of fantasy really like if you Enjoy heroic fantasy go ahead and check it out. If you enjoy White-hearted stories check it out if you enjoy epic fantasy check it out like if you enjoy dark fantasy I don't know how much this would intrigue you But there are some parts that you would probably like and yeah overall just really great book you should check it out Thanks for watching and thanks to all my patrons whose names are here But especially thanks to Appo Savalainen brother Santobes Christopher Quinton Christopher Hawkins Joseph Pendergraft and Tobacco crow you guys are you guys are great if you want to get your name on here then consider donating to my page You also get stuff like early access to my videos and voting on future video topics So you know if that if that interests you then go ahead and check it out And if you can't do that then like the video comments on the video subscribe to my channel If you haven't already and I will Yeah, bye


the next talk that we're going to have right now is cloud security metrics presented by Xavier Ash. Thanks guys. If you want some metrics I'll give you some metrics too but that's all right. So cloud security myths. So I like to make sure that I'm talking to the right cloud, there we go. So I want to get an idea of what you guys do so that I make sure that I'll give you the information you need. So who here is, you know, part of a sock analyst?  All right. So we've got some analysts in here. All right. So engineers, people that have got to like design security for the cloud. All right. Good. We've got to do this. All right. So that's generally where the talk is going to be aimed toward is those people. But we are going to talk, I've got some IR in the cloud and some other talks or other things about dealing with security in the cloud. So let's go ahead and get started. So a little bit about me. I'm old. I've been around for a long time. And I've most recently worked for Gartner. So if you see these terms that only Gartner uses, that's because they infected me with their terms. And so just bear with me as I use those terms as I describe some of this stuff. I've been in vendor world, consulting, did a little bit of my own business for a while. But I've recently switched gears. And after getting accepted this talk, I now do IR. So I don't do cloud security anymore. But, you know, I play a good one on TV. So now I do run an incident response team for a large financial institution. So I do, so that's why I put in the IR in the cloud stuff to make sure I cover that over. All right. So what is the cloud, right? So in general, most people talk about the cloud in these three general places, right? You've got software service, infrastructure as a service and platform as a service. And there's all these other, that is the three types of cloud, right? And I'm here to say that there's a lot more than that. And so we want to make sure that we all understand when we say the cloud, what are we talking about? I want to make sure that everyone walks away knowing about, especially function as a service and other serverless type of things, right? So function as a service is a big, you know, push. And for those that, you know, design security and design or work in a sock, we generally are not the ones that are going to decide, hey, we want to go do this function as a service thing, right?  We could, you know, let's do this new container stuff. And so as we talk about, you know, there's these three types of cloud, I mean four types, well, there's actually five types of cloud services. It keeps ever changing, right?  Integration platform as a service to be able to get data from here to there. A lot started off in the sales world. And if you use what's the ITTTF, that's a good example. Unified communication service for getting your voice stuff. Payments as a service. All these wonderful services that you might make sure that you cover when you design for security. So very important. All right, so everybody got it down. Everybody knows what the cloud is. We're all on the same page. It's one big thing that we can talk about easily, right? Security, cloud security is just one thing. That's, what I'm trying to drive home is that there's a lot of different things here. So let's kind of talk about how doing security is changing the cloud. One of the things that I like to really put into people's mind when we talk about shifting the mindset of what cloud means, we used to have these designs of saying we've got this perimeter, we've got this system bus, and we've got this architecture that really kind of starts with our data center. And that's not really the truth anymore, right? The truth is that the user, end user, is the center of that hub. They're going to go out to all of these different services. And this kind of, you know, this is a good talk, especially when, you know, if you get into the tangent about endpoint management, you know, a lot of big companies like to say here's a trusted computer, right?  I'm going to give you a trusted computer. Therefore, I can manage that and I can control everything you're doing. The problem is that that's not the case anymore, right? You know, we have, as the cloud kind of continues to permeate our business processes, this is going to be the perspective and our users are going to demand being able to use whatever device they want. And so, you know, this is side tangent, this is a nice change. So when we talk about cloud and really, you know, cloud security, we've got to talk about who does what. And I found this great site. It's called Pizza as a Service. And, you know, the link here, you can just remember Pizza as a service and Google it and use this in your conversations. When you're talking about what, who does what when it comes to these different cloud services. And so this, they've updated it to include containers as a service and function as a service. But as you see here, traditionally when we're talking about the, you know, the data center, it is, you know, we own everything. That's kind of like, you know, good old homemade pizza, right? And we're going to move to infrastructure as a service. This is what most people think of when they think of cloud, AWS, opening up an EC2 virtual machine. They are, you're handing over the responsibility for virtualization and hardware, but you still got the rest of the stuff to do, which is kind of like a communal kitchen.  So, but containers as a service, as we move into this, you know, paradigm of using containers that the OS is now no longer a responsibility. You're just, you know, moving around containers.    You just want that function. And then finally the party, right? Software as a service. Everything, you just show up, there's just pizza there. And so this is a good, good way of, of, you know, making sure that people understand who's responsible for what.  So, I also love the word hybrid. Everybody says, you know, well, we get this hybrid cloud situation, right? We're going to do hybrid cloud. And this is just as easy to describe as just the cloud, right? There's only one thing of hybrid. Hybrid is cloud versus data center. Well, you've got to make sure that you're, when you, somebody says the hybrid cloud, you say, well, what do you mean? Are you using the cloud as a backup place, a place to do disaster recovery?  What things are you actually shipping to the cloud? And do you actually have, like, a separate data center out in the cloud? Or do you really kind of extend your data center? You've got data center one that's here in my office and data data center two that's AWS. And you can't really tell the difference, right? So hybrid cloud could mean a lot of things.   But then when they say, hey, hybrid cloud, you say, well, what do you mean by that? And so dive into that, make sure that you know. So as we change through this, this different mindset of what, what stuff is in the cloud, one of the things that we're driving toward is this serverless world, right? Basically, as, as we got excited about not having to run our own hardware, then we said, oh, wouldn't it be great if we didn't have to run our own software? And, and we can just have more and more other people do things. And so as, as, as, you know, these cloud service providers have clued into this, they've said, oh, oh, you want to run SQL? How about SQL as a service? All right, well that's great. Now I don't even have to work and do auto scaling on one, I have one database and it can just auto scale on its own. And I don't have to worry about, you know, actually creating containers or doing anything. That, I just have a SQL database or an elastic search, you know, and it's just this thing that you can call and it expands and it is really easy to use. Problem is, is that you, without a server, there's a whole lot of things that break down when it comes down to security. As we move into the cloud, that is the biggest, you know, gap that we have as we walk away from this talk once you understand is that as we move to these serverless world, what things are not going to work? So I went around yesterday, the day before, I went to Black Hat and talked to everybody that had the word cloud on their banner, which was just about everyone, right? Everyone does cloud, you know, security in the cloud, you know, secure your cloud, best security in the cloud.  And I said, well, we do this thing and then we installed an agent. I said, oh, we installed an agent, that's great. What do I do with serverless options? If I've got an elastic search stack, how do you protect that? Well, yeah, exactly. So be sure to take away from this is that, you know, that understand that these serverless options are going to continue to pop up. And so as your company, as your organization moves into the cloud, it is not just going to be infrastructures of service.  These services are so easy to use and really accelerate, you know, time to deliver on security or time to deliver on business processes that they're going to happen. So we, you know, security guys, we can't say, well, we can't put an agent on that. So you can't do that. And the more we act like that, the more we're going to get kicked out of the boardroom. We have to be able to do security in the cloud and not say, here's what you can and can't do. All right. So what do I mean by security in the cloud? Well, so here is just a, you know, a quick list of the, you know, NIST control family so we can remind ourselves there's a lot of things that, you know, as security teams we're responsible for, right? And so as we, you know, think back of, you know, pizza's a service slide, right? And so there's a couple of these that we can go ahead and strike off. As soon as we do infrastructures of service, right, the baseline just put some VMs in the cloud, we no longer have to deal with personnel, security, physical and environment protection. Right? We need to make sure our cloud service providers are doing those, right? If you do SOC2, right, you have to make sure your providers are doing those, but you're handing off the responsibility. So it doesn't, you know, eliminate the need to do these, it's just somebody else is doing these. And so with both NIST and a couple of others in your cloud service providers, lots of big ones. For example, I've got, you know, great spreadsheets to go through and say, here are the controls and what you do, what we do and how to figure all that out. But generally those meet, those really assume infrastructures of service. And so you have to say, all right, if I'm going to have some Lambda functions out there that is going to be connecting, how do I authenticate to that? How do I make sure that that works? As that scales up and I have an incident on one of those nodes, how am I going to respond to that? All right, so another way of making sure that we're understanding what we do is we're going to use cloud security. There's really three kind of groupings that I usually say. Are we talking about like services, you know, cloud security as a service? You know, security things that are happening in the cloud? You know, things like proof point. You know, you send your e-mail through their cloud, right? So that's just kind of like security as a service. So that's one kind of thing when you talk about cloud security. There's cloud security products, right?  So those are products in the cloud and then there's, you know, for the cloud, right? And a lot of these are going to be run by the cloud service provider. You're probably going to use Azure or AWS's IAM, but there's also a third party one of those. So make sure that when, you know, again, we say cloud security, what are we talking about? We're talking about, you know, cloud security services, products in the cloud or functions in the cloud. Now, generally as I dive in here, I'm going to look mainly at the products in the cloud because that's where a lot of the gaps tend to happen. And so let's kind of dig in here. So I did label this talk cloud security myths. So here we go, here's some good security myths. I love this. I googled around and said, all right, I'm going to talk about cloud security myths and know what they're all over the place. But in general, I felt like these were myths that you would talk to non-security folks about. All right, so the cloud is not secure. We can't go to the cloud. Now, as a consultant, I actually talked with a couple of companies that still to this day, 2018 said, well, I can't trust my data in the cloud. These guys were not doing government super secret stuff. Honestly, one of them was a cigarette maker. I mean, we know how to make cigarettes. He's not secret sauce and you're not, you're going to be okay by putting your data in the cloud. They still did not want to make that move to say, okay, we can think about maybe doing some cloud, but we're not going to put any of our, you know, classified data in there. So that's one myth. So, yes, we hear all the time about, you know, data breaches in the cloud. This was found in the cloud. That's not the cloud service provider. When's the last time you heard Amazon hacked, you know, they jumped from one, you know, one AWN instance to another, right? That doesn't happen, right? So, you know, the likelihood of that happening is really low. So the cloud is actually really secure. I love this other one. The cloud is perfectly secure. Well, no. So, it is as secure as you make it. You put up data there and you leave it out in the open. Somebody's going to find it.  Yes, somebody's going to find it. So the cloud is only secure as you want to make it. There's a cloud security is too complex to maintain. This one, I kind of say yes. And here's why. All right, so the complexity to cloud security, and this is what, this is the me of the talk, is that all of these controls, you know, that big list of family of controls, we've got to design all these different controls.  I've got to be able to figure out how can I convert that control to all of these different services, right? We've got, you know, function of service, services options. How can I do that? And every week or so somebody's going to say, okay, but now AWS has got this new thing and it's awesome. It's going to revolutionize the thing. We're going to do it in six months. So security, you're going to have to get on board with how we're going to do this. And so, yes, there is a lot of complexity. It can be done, but we have to understand that, you know, you've got to be able to communicate risk to these people. Yes, you can do that in six months. You can do that in six weeks. But you're going to do it and, you know, it's going to be a much riskier situation because we're not going to have all of our controls converted for this new thing, new fandangled technology. All right. So all cloud service providers are the same. I'm going to jump to that in a minute. And then on-premise service is so much safer. I love this one because, yeah, we all know how poor our security is at our own data centers, right? So let's just not even go there. Yeah. Now, oh my God, cloud. All right. So cloud security truce. You've got to get away from this perimeter thinking. Now, there is, I am going to talk about like transient VPCs and how to set that up. And so there is going to be some aspect of, you know, building kind of, but it's because there's really two ways of doing that. Well, sorry. There's three ways of doing things in the cloud. There is agents. There is APIs. And there is network-based stuff. And so, really, you've got to make sure your solutions will fit one of those, one of those three. So with network-based stuff, we're going to create some transit VPCs to make sure that we can get the network traffic to go through our network products. Distribute threat service. Think about, you know, if you're going to try to protect all of your company's data and they start using the ERP as a service, sales there's data up there and there's all of these different areas where now you've got to, you know, apply all these controls and be able to keep that safe. So there's a distributed threat service. You will need new tools or, you know, make sure that the tools you've got are starting to get updated and become more cloud aware, become container aware, become more aware of what you're doing in the environment. Lots of new policies and procedures because, you know, just go a little back and read it and think about, all right, if I'm, you know, moving from, you know, from data center to a cloud, when am I going to have to rewrite? So, yeah, I already said that. It takes a long time to convert those controls. All right, so these are more equal than others, right? So this is a recent gardener study. They looked at, you know, took a large majority of the NIST controls and said, hey, except for IAM, we did another study on that. But it's how much, if I just go with what Amazon or Google or Azure gives me out of the box, how well am I covered? And it's really interesting how, you know, there's so many gaps on the Google side.  And so Google just kind of takes a different approach to it. While both Azure and AWS are trying to say, I want to give you all the tools that you don't have to go to anybody else, but there are gaps there. And the gaps there, you need to be able to identify. And this is just, this kind of simplifies the view to say, oh, well, again, are we just talking about EC2 VMs? Or are, do I, can I have the same level of logging if I just have a virtual or a elastic stack? So let's make sure that, we have our own analysis here that you understand and look at the options that your development team haven't even used yet. If they're not doing functions as a service within next year, there's going to be a Lambda function out there doing something and all of a sudden it's going to be mission critical. So go ahead and think about all those things and be able to do this analysis for your own company and your own situation. All right. So I wanted, this big search, if you have a gardener pass and get on and you look at the full study here, here are some of the highlights that I thought I would call out. So Amazon GuardDuty, great product. It does have a region specific thing. So if you guys that actually are working in the cloud using GuardDuty as your sim, if you have multiple regions, just know it's not doing cross-region correlation. So if you do have multiple regions in AWS, you want to make sure that you're using, you either assume that risk or use another sim to do your alerting. So it's a good take away. I love finding out that Google's OEM, they have the, it's actually semantic on the hood. They call it the Google workload protection. It's just semantic. And so if you have opinions about semantic, there you go. I've just given you more information to do something with. So Google does not support transit VPC. So as I said, there's really three ways of doing security. It's either have an agent on a box which we know that has a limitation. APIs, which of course has limitations because not every API gives you all the same access and or network. And so if you're going to be doing network based stuff and I say that you probably need to do network based stuff from IR and being able to do things on the wire, Google does not support transit VPCs. So keep that in mind as you're looking at these and of course there's more cloud service providers than just these. But we had to stop somewhere. So if you know anything about denial service protection Google is kind of like old school if they're going to just flood you with data then they've got protection. However, there's a method called scrubbing. We'll get into it right now, but that's a lot of the more modern denial service attacks are mitigated using scrubbing. That is a premium add on for Azure and AWS but Google does not have that at all. So again, when you think about which services to put in which cloud service provider that might move you one way or the other. So if you're applying the WAF on AWS that you really can only use on those two, either on cloud front or they're a load balancer. So there's other third party products I know five and a couple of others are really kind of looking to cover that gap, but the WAF has got a lot of limitations and the out of the box capabilities for AWS. Azure does provide endpoint security. I think that's interesting AWS doesn't even rebrand anything, so Azure does have that. I would encourage you to look at what's available out there for cloud based endpoint security for those instances in which you can put an agent. And then Stackdriver. So both AWS and Google have AWS and Azure have great logging tools. Stackdriver takes it a little bit further and it can do some debug level stuff which is great if you want to also do some IR. But what I thought was interesting is that Stackdriver can be used on AWS and so if you've got both Google and AWS look at Stackdriver to maybe consolidate logging and get a couple more features. All right. So transit VPCs. I'll make sure that everybody walks away with this. A technique that is definitely kind of required to implement a lot of the cloud security that you see over at Red Hat when they say, hey, we can do these wonderful things. If it is a network based approach, you're going to need to build a transit VPC. And that just basically means that I've got to run my network traffic through a VPC to be able to get this stuff done. So this is just a basic architecture approach but is overlooked by a lot of architects and realizing, oh, we're going to have to do this other thing. And so, especially if you're moving the cloud and get this in place beforehand, if not, go talk to your network engineers and look at implementing this so you can do things like package capture, IPS and other things on the wire. Right. All right. So now I'll get into some of these. Like I said, this is some of the gardener terms. So cloud workload protection platforms. All right. So this is a really big long word for endpoint security in the cloud. But in a lot of these products I looked at were just the same EDR product. They just put the word cloud on it. So what I want to do is if you are going to look at and you should, if you don't have already, is to look at these endpoint based solutions, here's what you need to make sure that they have. So both agent list and agent based operations. Most of these are going to be agent based to begin with. But see which ones can tap into APIs in the cloud and decide what type of functionality is useful so that you can get that threat protection and threat detection and protection coverage on those serverless options. Protection of containers. Even if you're not using containers today you will be soon. So make sure that your endpoint protection is container aware. So tagging and segmenting. There's another slide on micro segmentation. But being able to understand the traffic coming out of each container from a different instance and with all the auto scaling everything else, you need to be able to describe the data in very finite ways and make sure that if you are looking at or already doing traffic tagging and security groups that your endpoint security solution works with if you've already done the job of describing here's all of my enterprise bus traffic built to this great APS security group and I can identify those. I've done all of the microservices tagging and then you go and install this product and you can't see those tags. You can't work with them so you can't really write rules based off of that other work. So this is where the enterprise architects are going to be at the end of the day. If you want to make sure your security products can leverage it. So native API based integration especially if you're multiple cloud providers you need to look at can I integrate, have one console for both my Google and my AWS cloud. That saves a whole lot of pain and effort so if you do have a multi cloud integration make sure you can do that. You know traditional antivirus really not a big deal on servers however application control whitelisting you know used to work for bit 9 so I love this stuff but I think that that's a very key feature as well. So this is your shopping list if you're going to go look for this wonderful world of cloud workload protection platforms i.e. import security. Alright next category of you know miraculous solutions is the who here has even tried to use Caspis out in the field? Anybody? A couple of hands over here. Caspis tend to have gotten kind of a bad rap because back when I was doing consulting I asked her so what about Caspis? They're too pain, they're for this size company we're too big for them or you know they're too complicated and they can be complicated. Caspis in general is this group of products that says I need to put something in between my user and my typically SaaS providers to do additional stuff. So when we talk about converting controls over to the serverless world there's also all these you know software as a service providers and I want to do things like you know authentication. Well yes you can go and do you know they've got you know now can really help you with that but the Caspis products kind of do more than that you know allow you to do can add on additional encryption can do some encapsulation do adaptive access control I've got a couple of features here and yeah I've got and there's multiple architectures on the way that these work and I've got them on my next slide but one of the main features is you know shadow IT so you can kind of go start getting a hold of these other products so of course yes if you've got proxy logs your splunk could probably figure out who's using these other you know shadow IT products so I wouldn't go if that's your only use case I wouldn't go out and buy a Caspis just for that but you can then apply start applying some of your security controls to those products in a Caspis product and so like I said you can apply those to your sanctioned SAS and then also be able to apply those to any of the unsanctioned SAS that you come up and you can start onboarding those but how do they work so there's generally usually three four is there as well so there's API mode so basically in some Caspis they just say I'm going to talk to the SAS provider and I'm going to tell it it's got API there and they know you're coming from you know company X and we're going to apply all these controls for you because we have this native integration so this is API mode and a lot of the big SAS providers work with a lot of the Caspis out of the box and can apply your security controls without necessarily doing a man in the middle the two men in the middle can apply forward proxy mode or reverse proxy mode won't necessarily get into the technical differences there but you know you can understand that the other way of doing this is you've got to basically put yourself in the middle and then broker those communications so that you can apply those security controls like authentication encryption and whatnot and then there's enterprise integration which is a complex word of saying that I've got all these other little products that I can tap into services so again I was going around all these providers yesterday or vendors yesterday and asking about them so and they describe how you're doing this oh so you're kind of like a Caspi right I'm not really a Caspi ours is so much different right so it's like no you're a Caspi so this is one of these product solutions that in general I do think that most Caspis is still a fairly new set of technologies and if you're a large enterprise probably not going to be able to meet all of your demands there might be now some of the Caspi products but started to like put a lot more enterprise features but this is a good men market program if you've got a very small data center or no data center and your company runs a whole lot of different SaaS products I would look at looking at some of these to help fulfill some of your security needs like I said this is one of these network based solutions that can apply security controls for SaaS and other security other cloud service technologies without necessarily having to you know manage the full agent so everyone's heard all about you know I've got this breach data over this so this is a mandatory thing is to make sure that you understand how you're doing ongoing cloud security posture management you know Gardner used to call this cloud infrastructure security posture assessment SISPA but then you know the congress decided to create a really bad law called SISPA now you don't want to call things SISPA because everybody gets all fussy and says E-F-L-C-S-S okay so we're gonna call it cloud security posture management now and so if you only have you're only doing things in one you know AWS or just just Azure they do each of the products do have their own like you know checklist toolkit however this is one of those areas I think that defense in depth is probably warranted right if you're having the cloud service provider tell you that everything's okay and in general that might be good enough for you but if you think that you need a little bit more there are third-party products there's open source there's a cloud sploit I think is one of these there's a lot of good let's see right now we're down to cloud scout to, prowler, security monkey, cloud custodian and cloud sploit so just look out there for those type of solutions and what they'll do is you know look to see how you've got things set up and constantly tell you hey yep you've got an open EC2 bucket right you know that's the kind of sploit and so this is this is your security blanket make sure that nobody over there that has the permissions to do so does something stupid and you can immediately respond to it so mandatory tool in your cloud security toolkit software defined perimeter anybody know what this one is oh I got one one alright so software defined perimeter I really like this because I worked for a start-up and this is kind of what we did we didn't call it this because we wanted to be cool we wanted to call it micro segmentation because you know NGX was talking all about micro segmentation we're like we can do so much better but this is basically the type of solution it says I'm going to put everyone that I've seen so far is agent based I think some may have APIs but the idea is I got an agent on one side I got an agent on the other and based off of different situations I can do different things with that situation so if I've got an agent on the endpoint I can actually stop network traffic from getting to through the IP stack based off of this broker's decision so for example you can do authentication before the TCP session is even established so you can make things disappear that's why I call it software defined perimeter server on the internet and it says I'm only going to allow other endpoints because I've got this third party broker that's going to say I'm coming in authenticated this IP over here he's good to go you can open up a TCP session for him all these other ones you're just going to drop the TCP session so I think it's a really neat way of doing security you can also do things like add encapsulation and again you can look at this for east west traffic as well it doesn't have to be client server that you can do this in the data center again most of this is agent based but provides some really interesting security you can make machines hide off the network unless you're part of this brokerage solution really neat tools there alright micro segmentation no cloud talk is good without micro segmentation like I said worked in this for a couple of years so micro segmentation this is my definition here because that helped write a lot of this it's basically saying I want to make a decision on whether traffic is allowed to flow based on something more than just IP import alright so I can say this is coming from these set of servers and it's coming from these sets of services so I know that this data is held up I don't need to do protocol inspection or anything like that I can just go ahead and say yes I can identify this, I can tag it and then I can link this in with my networking solution to then provide a lot of east west control on making sure that only traffic that should go where it goes micro segmentation is being built in the last software to find networking products it's obviously available I said the NGX product from VMware and I'm seeing a lot of enterprises start to actually push out you know import agents and start participating their entire company and doing micro segmentation most of the and so the architectures there native micro segmentation is in the cloud or with VMware third party model is I've got some other product that is going to come in and do it for me and then the overlay model is the agent based model like Illumio and then the hybrid model is using some combination there so in cloud you've got micro segmentation natively so if you're doing any micro segmentation in your data center you can carry that over to the cloud and make sure that if we're using NGX the tags carry over and you can create an enterprise wide micro segmentation scheme a lot of people get worried about the micro segmentation I've got I didn't put that graphic in I've got complex city I've got VLANs were hard but now you're talking about micro segmentation thousands of different so a lot of people I've seen enterprises call this macro segmentation but this model we're just going to simplify it do macro segmentation either way it is a very strong control that you should look at and when you're designing your cloud solutions because when you look at the number of controls and you look at a lot of the serverless options sometimes you're just going to have to segment that stuff off right I can't put an agent on it it's encrypted traffic but I can't do anything else with it so how can I secure my data layer in the cloud so you can do some micro segmentation make sure that only the approved services can connect to that and really you have to do micro segmentation when you're talking about auto scaling a lot of the dynamicness of the cloud so it's in response to the cloud so we'll talk a little bit about how we can now make something bad has happened right so one you have to plan for IR in the cloud so of course a lot of this is logging but logging is always not enough but when you are doing logging I would look at things like write once storage S3 bucket versioning is a good way of making sure that as you put your logs in that they're immutable and then also index all of your SaaS services if something bad were to have you know that we kind of laugh about oh those are the sales guys using Salesforce what do they really need instant response for oh I lost my contacts I'm sorry if you're sales guys the sales team loses a whole bunch of stuff trust me that's going to be a big IR situation because the sales guys a lot of companies run the company right and so if they can't sell stuff nobody's getting paid so we got to go it's a big deal so go talk to your SaaS providers and figure out what can I get access what can I get in get the data it needs get the whatever logs whatever different captures that I can get plan for that stuff and this is also where you might look at it and say hey I think I might want to look at Cosby's now because now with Cosby's I can start doing capturing some of that network data so if I don't have net witness on every single one of those and so I can figure out how to respond for my software as a service providers note that all of your cloud service providers they have their own IR process and if there was a situation if there's a data center on fire they're going to let you know so if you're you know part of IR part of the sock make sure that you one you've indexed all of your cloud services and two that you know what their IR program is if you're mature enough to be able to sit there and pull sock to reports that's great but you know to go and you know Microsoft and Amazon they all have really good you know explanations on how their IR process so just remember because there's different levels of responsibility that IR process might be kicked off by your actual cloud service providers so just make sure you have that in your mind so a couple tips here so EC2 we can actually you know if you've actually got you know VMs there you can do a snapshot capture in EBS Azure you can actually you know if you've got you know IIS OS you can just capture the data drive directly in the portal Margarita shotgun great little tool for doing memory captures especially in the cloud and if you're on AWS there's this great combination of toolkits called the open source incident response toolkit it's got a number of different tools packaged together and that way you could actually start up you know have an IR station in your cloud so that you know when you go to capture something you can go ahead and just mount it on your IR instance and you can go and start working away so again IR is not waiting until it happens to put all this together right so build all that out and that in the security center Azure's got a pretty good you know playbook based system in its security center that can help a lot of the IR automations and of course if you've got something like Demysto they all kind of tie into those so again just like with the enterprise the endpoint security stuff if you're doing automations like rainbow tables just show this you know make sure that they can connect to your cloud so again the takeaway here is that you know there is lots of different things in the cloud there will continue to be lots of different things in the cloud and we have lots of different security controls that we have to continue to do it's very hard to keep up with that and so we have to make sure that we index as much as we can and we can communicate those gaps and also you know so that you can intelligently to vendors and they say hey you know this great beautiful thing that you know here's what it can do right but how does it work because that's going to tell you what kind of coverage you have so I appreciate your time for coming out and if anybody has any questions I can take a few now otherwise I'll be around in the back to talk a little bit further so any questions? I answered them all great well I appreciate you guys coming out have a good DeafCon