So good morning. Good afternoon. Good evening depending on where you are. I hope you can hear me loud and clear Thanks for having me here. It's a delight to be here at open source summit once again This is my second time at open source summit after that happened in Shanghai last year Unfortunately due to COVID-19 all of the talks this year are virtual And I hope many of you would have you know taken this as an opportunity to attend as many talks as possible And I'm really glad that it could join into my talk. I'll be talking about IOT developer's guide to building a secure IOT devices so But before we begin a quick introduction about me I'm your guest and I'm from Nepal. I work for a company called Tata Consentancy Service India Where my primary research and work focus in IOT security hardware hacking and mobile application security? Apart from that, I'm passionate about car hacking and robotics as well When I'm not working on security, I'm probably building robots for fun. I'm also an active speaker in the community I've spoken in front of several conferences like cyber week a great hack and Kazakhstan mainly and security I sometimes write in medium as well. So you can find me in medium as medium.com slash at Yogis Oza So that's pretty much about me. Let's look into today's agenda We'll begin with introduction to IOT a boot spaces failure stories which we followed by current security challenges in IOT After that, we'll talk about threat modeling where threat modeling is very important for developers and how to build one of them The other topic where I'll spend a lot of time talking about is the wasp top 10 vulnerabilities If I'm not aware of what wasp is it's a nonprofit organization that releases the top 10 vulnerabilities that has been observed in the last couple of years They do release this document for developers and security guys and you can have a look at them Probably you can use it to train your developers about the security issues as well We'll also talk about the best practices in terms of security towards the end of this talk We have a lot to cover today a lot of material to cover today So let's quickly dive into the talk and see what's going on with IOT security So the goal of this talk the talk is intended for developers to help them understand the security issues Within the IOTM and this talk is probably you know after this talk probably It'll help you implement the security in your IOT SDLC as well But before we you know begin the into the dive deep into the world of IOT security I think it's better. We talk a little about Internet of Things So the Internet of Things is basically the network of physical objects Device building vehicles and other embedded electronics and sensors that enable this object to interact with each other Extends data and make smart decisions based on the data that has been gathered from the environment Also an IOT could be any device connected to internet irrespective of Computation power price and the size of device So what you see on the screen is the schematic of Internet of Things on a high level if you look at the schematic of Internet of Things it consists of a hardware or software and a cloud The hardware may consist of sensors your processing unit embedded CPU or a microcontroller and storage We now have software now this software might contain the firmware mobile application and the web application Depending on what your IOT device does with it This may have network communication as well with most of the times it's a bidirectional communication And a device may interact with other other little components using protocols like blade with low energy or ZigBee as well So now now let's look into the IOT architecture component And if you look at the IOT at a broad range the hardware that we spoke about the software that This device is carrying and the application can be aggregated into a layered architecture This is very important to know because when we talk about the security issues Understanding the architecture will help you correlate the common pitfalls of IOT within the layers And they could be solved within the layers as well So you could find many architectures for IOT this varies from company to company people to people and many Based on the requirements many of the architectures are based on one common architecture And that is divided into physical device is and the platform Physical device could be anything that could be identified as things in the Internet of Things This physical device also have some computing power that and and the chances are that it is directly attached to actuators or controllers Depending on customers demands and capabilities the processing power and connectivity may vary Then we have is with consist of sensors and actuators and at last we have platform Which is the centralized component that manages the flow of data This also in a broad term can be classified into application layer data processing layer Network layer and sensing layer on a normal iot device. Let's take an example of a fitness tracker The mobile app so the mobile application in your android ios that you use is in the application layer the data processing layer consists of a CPU That calculates your daily activities your fitness performance and and does the analysis on top of that, right? So on a network layer you could have seven protocols like a bledged low energy Bledged classic or mqtt running on top of that So the remaining components like the pedometer the sensor the gps are in the sensing layer So this probably would have given you a brief idea about uh, you know Uh about the architecture next we look into the evidence cases and come on pitfalls for iod device So now if you if you look at this now you've got this smart If you talk about the things in the internet of things you have got everything out there You have your smart coffee makers. You have got a door locks even smart guns fitness trackers and many more You also have the healthy devices as well One common thing between all of these devices are that they all have connectivity They all have a tiny little cpu and sensors that work together to perform some action The other really common thing between all of these devices are that they're poorly designed with no security in mind They all have history of being hacked They there are many reasons where these devices are poorly designed with no security in mind Which of course we're going to discuss about it later today Uh, now let's talk about the iot failure stories Uh, if you if you remember the things in the internet of things We have had the variable implants that the healthy devices, right? They're also known as pacemakers They're used for people that have slow heart rhythm This was found to have weakness in the transmitter allowing potency need to Change the pace battery depletion and even suck in other words that it was there The other the other fairly iot failure story that cannot go unnoticed is that uh In the mirai boat made back then in 2016 This was probably the biggest distributed denial of service that ever happened And just to make things even more interesting for you. Um, uh, there was one case back then in 2018 This among uh, this is one among many cases where the vulnerable iot devices Were used to compromise or you know target the companies for the very first time This is a very interesting case back in 2018 where the attackers used a thermostat that was connected into a feast tank Um, that was placed in the lobby of a casino to gain access to the casino's high roller data mix And and these kind of attacks keep happening. One of the major problems with iot is that they are very basic and cheap Various reasons like the time to market the cost and many other reasons these devices like the thermostat The refrigeration the smart bulbs and several other smart home components. They often do not include the added security And as we keep on to add up more and more iot devices We are just increasing the attack surface And what it is true that many people are working on to secure these devices But still we are a long way off from having the secure iot devices As we move on to integrate more and more devices move more We as we move into more and more connected future. We need to understand the root cause Are we trading off the security for the sake of convenience or not? The very common pattern when I work with customers we tend to identify the root cause And and and this root cause belongs to developers and the vendors The consumer in an industry is always looking for secure iot devices without trading of their convenience Well, on the other hand developers and vendors are worried about their complexity Many times developers are not aware of security issues The vendor are not aware what to do next when something wrong happens Or even what can be done to achieve security without complexity These are constantly they are constantly looking for suppliers That can provide them devices and hardware at a level of assurance that they can bring in security without complexity A root of trust has to be established between all the parties and entities Also security must be considered early in the design phase early in the marketing and engineering development cycles of devices As well as services. This is because when I'm talking about iot I'm not just talking about the tiny little hardware box rather. I'm talking about the entire ecosystem The entire mobile application the the mobile application communicates to the the web interface the administrative administrative console and a lot of components inside your ecosystem The web application dashboard the tiny little sensor attached to it and a whole lot in the ecosystem, right? So it is very cheap for developers and for companies and vendors to Identify and mitigate the issues early at the design phase rather than after the production So the current situation, uh, if you look at the current situation of iot, it's it's a little worrisome The security is actually missing from iot, which I really believe should never have happened should never be the case I do not see any fundamental or groundbreaking reasons why security should never be a part of iot Somewhere down the line I feel that security and iot has been discarded by developers for the sake of convenience and on the vendor This has been discarded for the sake of early time to market Currently the competition on market is is is for early time to market Is for is for early time to market competition on safe and size And dimensions right but not really on security That currently millions of connected devices and billions of sensors Surprisingly the numbers are growing rapidly and all of them needs to be secured Hence it is important that a well-designed security iot architecture are most requirement And if you have been looking at the attack vectors where the threat actors have been attacking it's everywhere They have been attacking a device gateways the firmware or the operating system the software even even on the software system and many more So a vendor can't just secure a hardware device and call themselves a secure We need to check on the gateways the sensors the firewall that they have implemented the mobile application The operating system the software system and many more So vendor So and and and if you look at the current situation as I said it's a little worrisome But there is a lot to act and there are a lot of challenges as well I think we have had enough of problems in iot. Let's focus in the current security challenges and and and look at the ways to solve them By now you must be already asking. Hey, there are billions of devices But what is the problem where all this began right when I work with vendors and companies One of the major problem that I have seen with companies and vendors is that People and companies think that iot security is all about device security Still many people think security in iot means securing the physical device Which is not true When we're talking about security in iot it is all about securing the entire ecosystem Your ecosystem includes you as I said it includes your mobile application your cloud communication your device device communication Your web application and various other component if any of these components are insecure This may lead to the compromise of the entire ecosystem and not just a physical iot device So next time you hear somebody saying iot security is all about physical security You need to correct them then and then And developers need to focus and secure securing the entire ecosystem rather than the device alone The other problem is that the dependency issues You so what what happens is that your one vendor may rely on the several other vendors It is pretty tough for one single vendor to build the entire ecosystem So they might rely on the several other vendors It might so happen that your mobile application might be procured from one vendor And the hardware components might be procured from another summer in china right and the vendor summer in china The next question that arises is that how secure are those vendors? Do you have any controls over then do you have any idea where your customer's data is being sent? If the answer to this question is yes, then you might be doing a great job in securing your iot ecosystem But what if one of these components is not in your control? This is where things get serious and and this actually I think it creates a major problem The other problem that I've seen in the industry is that the never-ending growth So the number of devices the number of component keeps growing at an exponential rate IOT technologies are not match your yield and there are many challenges to overcome There is no way we can control the growth of these devices And I don't think we should be as the number of devices continue to grow There is a lot of attack surface as we keep on to integrate more and more senses as we continue to integrate more and more Interfaces we are increasing the attack surface And also as I spoke about the dependency issues. What is the vulnerability lies in the third party vendors hardware? And the vendor has no way to provide the pads How are you going to handle this? And and these are the kind of questions that are developer must always be prepared before building and secure Uh building an architecture for your secure iot system The other problem that I've seen in the industry is that there is too much a cross between all the components So what what happens is that the solution to this is implementing the zero trust philosophy? So implementing a zero trust philosophy in iot network could be an essential step in securing the entire ecosystem So where this is important? So what happens is that in a traditional architecture, uh, the traditional architecture believes that even if you compromise any components in the network Rest of the component will treat you as a granted Since you have already since you are already inside the network you remain to be authenticated, right? So rather a zero trust philosophy implements much strong authentication and requires strict verification Even if one of the component or the device in the ecosystem gets compromised What this does is that this prevents the lateral movement inside the network Even if the even if your iot device gets compromised So like the one early in the 2018 case of casino Had it been a zero trust inside the network the attacker wouldn't be able to gain lateral movement inside the network, right? So we have spoken a lot about challenges. We have spoken a lot about the problems Let's let's try to focus on the trial and and the ways to solve it. So, uh Those are the pretty much challenges in iot security and of course there are plenty of them We're not going to discuss all of them, but you can consider them as a primary challenges Now to understand threats much better in their counter measures We'll first look into the threats correlate them with the cia trial and focus on each of the counter measures So on a typical iot device common security threats are unauthorized access physical physical destruction information decays Illegal data modification denial of service attack malware based attack and and this can pretty much be correlated to cia trial so If you're wondering what cia trial is it's a fundamental to information security So so what happens is anytime your data is leaked Okay, anytime a system is attacked or any any number of other security incident occurred You can be certain that one or more of these principles have been violated So we evaluate threats and vulnerabilities based on the potential impact They happen the confidentiality integrity and the availability and based on the potential based on the evaluation We propose a set of security controls to reduce the risk So let's let's quickly focus on each of these security requirements and let's have a look at them So we'll begin with confidentiality. So confidentiality is a property roughly It's related to privacy Any attack and data at first data in process and data in transit could could occur in loss of confidentiality Some some common attack that could hamper the c in the confidentiality is that the man in the middle attack and the replay attacks and the security requirement For preserving the confidentiality in the iot device is that the transmitted masses should be encrypted to prevent the man in the middle Snapping or eaps dropping Similarly, the other counter measure could be taken to preserve the confidentiality is that the device should be tamper resistant The requirement tamper resistant is put up because the sensitive data that developers show inside the hardware chips Also detection and defense against the malware based attack are also important for preserving the confidentiality Now we have now the other thing that we have got is integrity Integrity is a property that maintains the consistency, accuracy and trustworthiness of data over the life cycle One one simple requirement to put up is that the data in transit must not be modified This in terms of iot can be simply put up as applying data integrity verification to avoid the data forageries, right? So similarly for former abuse developer must cryptographically take the former integrity before Obviding the former or applying the pads This ensures that the developer has actually built and developed the former and no modification has been done on the former otherwise Similarly other attack on operating systems like modification of system configuration to gain privilege escalation and also can be classified into data integrity There are simply an effective solution to preserve the integrity like sexums You know, uh, take me the former update or or you know or any data in transit or you know Even even cryptographic sexums can also be implemented There are of course challenges in implementing the encryption or crypto on a constraint Hardware for example 8-bit microcontrollers with limited RAM It could be really tough, right? So the encryption should be implemented directly into the hardware What integrity or has it has to be attached to the data payload or in the application layer This reduces the load on the constant hardware exponentially And now we have got the other property called availability and and and this ensures the high availability within the ecosystem This ensures that you're that you have done a pretty much good job in protection against the denial of service hardware failure Power outages and and the updates as well last but not the least we have authentication authorization This involves giving any access to only legitimate users and providing them access based on the role This also involves password management authentication access control issues Not only the application the authentication, but the device level authentication or device level security is also equally important hardware security chips like tpm allows devices to Securely authenticate themselves using you know public key infrastructure the pki also known as pki So this is this not just ensures the authentication is done But also ensures that the aftermath aftermath as well So let's look into the wasp top 10. I hope you have had a clear picture of what requirement have to be put up Now let's look into the top 10 pitfalls that developers make mistake. Well, uh, that developers make mistake and it's a much much worse I think I explained already in my slide what wasp is once again If you're not aware of what wasp is wasp is a nonprofit organization that releases the top 10 common security pitfalls to wasp for They do this periodically and update the list and of course wasp does a lot of you know good stuff and dev ops DevSecOps stuff as well But releasing the top 10 common pitfall is one of the major things they do So the wasp top 10 list is published once in every two years So hopefully sometime in 2020 uh end of 2020 We should be able to see the new update and take a look at how things have changed since 20 since 2014 When this was first released, right? So We'll talk about the top 10 security pitfalls. What are the kind of Pitfalls that keep appearing and this will help us to identify the vulnerabilities inside our iot application at an early stage So the first on the list we have is a weak guessable or hard-coded password It is no surprise that weak guessable or hard-coded password is on the top list As a security analyst, we have been uncovering this weak and guessable password since the day one And it is quite easy to figure out where this is even in the list This is because how manufacturers and developers use different passwords within the web interface root access or your secure cell access Or the telnet passwords, right the different passwords have been put up there This is also on the top because the attacker won't even bother about testing other component that could lead them to bypass the authentication It is evident that once the attacker has the authentication bypass pretty much every other security measure that we have implemented is obsolete So they won't bother about how fancy or secure or active to all with them are pretty much everything else is obsolete And not just this we have seen iot product that comes with a default password And do not allow the interface for users to change the default passwords So the key takeaway for developers is that do not assume that the users will ever change the password until and unless they are enforced to do so So all you have to do is provide an implemented interface through which user must and should change the default password Probably when I see with the default password and on the first boot ask the users to change the password compulsorily This also this this also includes any api keys that has been exposed inside the ecosystem any api key that has been hard-coded inside a mobile application Right or any unauthenticated api within your web interface The second on the least we have is insecure network services So the second on the least we have is insecure network services This includes any leftover ports any services that you have with debugging ports or the secure cell access or the 10 line Services or any other open port that are left over which are unused Remember always one thing as a developer you should note the note down is that The the very moment when you open open of these ports and network services You are opening up the entire attack surface. You're increasing the attack surface And and and sometimes due to the quick and easy implementation of insecure services Developers prefer using ftp instead of secure ftp or tell it over Secure cell access and if you talk about numbers 75.0 for percentage of attacks at on iot originate from telnet protocols This is how serious is it not to use the insecure services? The third on the least we have is insecure ecosystem interface This list includes all the vulnerabilities that lies inside a mobile application In a web interface, you know api is in a cloud console and the witness on any other ecosystem component The list of vulnerabilities are long but most commonly found are the cross-eyed scripting remote code execution or the operating system command Execution are known as os command execution also known as C surf or on web interface On the api things like unauthenticated api SQL injection You know overprivileged apis are relevant one on the mobile application side This includes hard coding of sensitive information inside binaries So insecure components and insecure apis are also prevalent inside the apis as well So now the fourth that we have on the list is the lack of update mechanism On many of the iot device simply the former integrated sake lack of insecure former delivery delivery of former updated Former that has been signed on stdp caused this kind of issue also many times this developer's device This iot devices have in sick inefficient anti rollback mechanism This is important because when there are critical vulnerabilities in the version x suppose that there has been uh, You know recently discovered a critical vulnerability in the version x You might roll out the version y but due to the inefficient anti rollback the developers will anyways downgrade to the version from y to x It's it's pretty common. Why it's obvious So always remember that the inability to update the device itself is a security weakness Failure to install the update means that the device remains vulnerable for the indifferent at time So the fifth on the list is the use of insecure or outdated component This holds very much true for industrial iot where the huge number of legacy systems are still being used This is because legacy systems are often expensive and technically difficult to upgrade One one vulnerable component Can cause and can make it all the security mechanism that you have implemented So it's very important to keep track of vulnerabilities occurred on the component or the libraries that are being used so the next The next one we have is inefficient privacy protection So this list equals all other vulnerabilities and all personal data must be stored and transmitted in a secure manner Which iot device have commonly failed But this this particular case considers privacy in a deeper sense to solve this problem You need to know exactly what data is being collected by the iot device What other iot device have sorry You need to identify what data are being exactly collected By the mobile application by the cloud interface and you need to make sure that the data necessary for functioning of device is only Corrected those data needs to be checked and whether there is a permission to show Personal data and then do you comply with any other compliance like GDPR or not should be said and and should be protected Whether it goes against those kind of compliance issues or not So what can you do about it? What can developers do about this simple solution store as much Sorry store as little information as you can As little personal data as you can even if you have to implement a data protection policy And for and for unfortunate situations this had ahead the incident response plan So this might help you in case of any You know attacks or in case of any data exposure The last few on the list are insecure data transfer and insecure in the lack of device management This both commonly deal with the device issues which talks about lack of encryption And access control in regard to handling sensory data and implies to both data at rest and data in transit What's the lack of device? lack of device management talks about managing the iot device in production If in case they have to be decommissioned if in case they have to be You know out of the production. How do you do it? Many of the iot device currently lack this feature And and this is very common in industrial iot as well The other we have in the list is insecure default setting This holds true because default settings default password configuration at iot devices default configuration on iot devices Are often insecure and this is slowly changing some lawmakers have been fighting for this For example, the california has a law that requires iot device manufacturers to set the pre-programmed password Or require users to change the password before even using the device If these kind of little security measures finally security measures are implemented Then I think we have we have reduced the attack surface by a little The last on the list we have is a lack of physical hardening this talks about tamper detection Hardening the physical debug port and easily accessible iot device in public places are what to be looked out for But developers your assumption must always be that your users will always open up the device inspect and modify it Not all users, but some users will definitely do that and with enough motivation. They'll most likely break a device So you must focus in You must focus in you know physical hardening as well not not only on the software component, but on the physical hardening as well So, uh, I think we we have covered up all the top 10 vast vulnerabilities Now since we have identified and launched all the common vulnerabilities, let's architect the security model for an iot device The one that you see on the screen is is based on the arms threat modeling for iot device And we have a huge topic today to cover up about threat modeling that comes ledger There are a couple of things to do before actually making the threat modeling. So let's let's quickly have a look at that So when you're when you're you know defining the security Secure architect for your iot device the first step that you always want to do is asset discovery The first thing is to identify the asset and keep a track of it If you're on a mission to identify the threats and I didn't always stress The first thing that you always want to do is identifying the asset the very next question that you might want to ask yourself is that What are the most valuable asset for you? Is it the former hardware? Is it the former or the hardware component in most important for you? Or is it the software component? Is it the sensor attached to it or what is it? So this asset discovery phase answers those kind of questions Identifying the asset will help you gather or say find out the potential entry points for an Attacker so so the next question is what consists of an asset? It could range anything from firmware to a sensor attached It could be anything within the ecosystem from a web application to a mobile application as well The next thing is that generating the attack surface once you have identified the asset You would want to generate the attack surface the attack surface is all about mapping out what parts of the asset or the system Needs to be tested for security vulnerabilities The point of attack surface is to understand the risk associated with the iot application The other point of attack surface is to help developers and security guys be aware of the parts of the application That are likely to be attacked and of course find out ways to mitigate them as well And finding the and finding the change in attack surface is also very much important When you add new new asset when you add new You know when you add the new asset finding out what happens to the existing attack surface is very much important What happens when you add the new component? What happens when you add the new asset? Does this increase or decrease the attack surface?  So this would have questions that you that you must be ready for Once once you have identified the attack surface The next the next thing is that you're looking at the pipeline is threat modeling threat modeling helps you identify Is the potential risk which of the components are exposed to certain threats? At this stage it is assumed that you have a clear picture of threats and exposed Uh, and all the exposed thread you you have a clear picture of that Uh, you you also have a clear picture of all the entry points to which the threats are applicable Performing a threat modeling is very important because this helps you understand the security requirement and identify the threats before the bridge occurs And of course, there are a lot of threat modeling and I feel this is a missing missing puzzle in most of the organizations The other one that we have is animating the threats once the threat modeling is done One needs to identify the severity of the threats. What needs to be mitigated first? What alliance with our security requirements and what does not? This also helps you achieve the security objective and and address the threats that needs the immediate attention We use something called a common vulnerability scoring system also known as cbs is It's a scoring mechanism between 0 between 0 to 10 that tells how severe the vulnerability is Suppose if a threat or a vulnerability gets a score of 9 to 10 we classify them as a critical And of course this needs to immediate attention Now once you have identified all this the last one in the step The last one the pipeline is generating a threat summary table Once once the threat have been identified and enumerated the next step or the next action point for the For you for the developers is that to generate a threat summary table This threat summary table will have needs to have what threats you have what mitigation mechanisms could be and how do you How do you enumerate those threats and how to remove those threats right so those kind of threat summary table has to be done So this threat summary table will help you bridge the gap between what vulnerability you have and what are the what are the mitigation mechanism So a threat mod once the threat modeling is done Making a threat summary table is also equally important So now let's let's go back to the basics and visualize each of them So earlier we spoke about identifying the asset right so let's visualize what kind of asset that you need to identify So your component will include any hardware peripherals the sensors the communication The mobile application this also includes any sort of networking device you have far well as well right So I actually believe the asset discovery must be a continuous process scanning the asset passively Meaning avoiding any unwanted traffic will help you keep track on each asset So anytime anytime you release a new product or you release any update for your IOT device or IOT component. You're not missing out any of the asset You're not missing out any any API calls. You're not missing out any components on the cloud or any communication protocol So it is very important that you do this on a periodical periodic basis and on a continuous basis The second step is to build, you know the second step in building secure architects of IOT is identifying the attack surface Uh wasp also releases the non-exhaustive list of attack surfaces and the attack surface that you see is a part of it I do not want to spend a lot of time talking about this probably you can take a picture of this And of course you can find an wasp website as well Um, because anyways, we are going to visualize this in the next coming slides So let's focus on the slides. Yeah So visualization of attack surface, um, so if if let's put put all those attack surface that we recently saw into several stack layer and visualize each of them so that we could We could figure out the mitigation mechanisms based on the layers The most bottom layer is the hardware and secure boot services The common attack surface includes the open debug ports the plain text communication bus the insecure storage tamper detection and and side channel attacks If you see the bottom layer is the most fundamental level and must be protected at all costs Because it is the fundamental basis for all for the trust on all the higher layers This layer provides the secure boot services and the critical components as you as you go to the top As you go to the top of the layer The attack surface increases dramatically because there are so many ways that a malicious attacker can attempt to compromise the system The key to build secure architecture is that is to have a really strong layer one and layer two This is because the attack surface is very Small in this layer one and two and it's very easy to mitigate them And since the entire process of the system lies in the layer one and two I think it's it's important that you identify and mitigate the Uh, you know the uh mitigate the attack surfaces in the layer one and two very important As I said as you as you move on to the top the attack surface increases in this layer the former and core services The attack surface includes the former the upgrade mechanism the local data storage and the pass management The most common vulnerabilities include missing encryption Hard coding of sensitive information the hidden back those many times developers leave all the hardware certificates inside the former itself And there are several ways with ways with with with which an attacker can gain the former So if an attacker gains the unencrypted former you you have pretty much everything The other most common vulnerabilities that I have seen is that developers hardcore certain sensitive URLs Apart from that we also have seen n-person keys being stored inside the former itself The other is that the communication layer where the attacks like man the middle the replay attacks and jamming based attacks are relevant This is this is the communication layer now on the application layer This is by far the largest attack surface that you might ever encounter your mobile application This this includes your mobile application your web interface your administrative console the vendor backend apis hot party apis You know your uh, you know, uh, you know your cloud interface They all combinedly serve the largest attack surface And the attack on this layer consists of the sequel injection the cross-site scripting c-surf Week password and on the web application there and many more as well Similarly on the api you you you would find issues that you know unencrypted Personally identify information being leaked being sent over the sdp Which causes the privacy issues and this also sends the user location sometimes So you need to check out on those issues as well Now the on the last we have is the authentication authorization part now on the authentication and authorization part This carries a significant risk and also provides a larger attack surface The most common issues the most common issue that I've noticed among the developers is that the developed unauthenticated api But debugging proposed and leave them unattended and leave them, you know off in the production as well This most of the times allow the higher privilege access The reason why I've kept this on the top is because when authentication failed pretty much every other security issues Are also failed right so Take out on these kind of issues as well the issues like missing authentication the privilege escalation. So make a checklist of all checklist before sending out on a production that whether you have mitigated all of these attack surfaces are not So I think somebody has asked the question. What's your recommendation? When you have to trade up between security and product cost, I think the next couple of slides is going to answer those questions So to do that, let's quickly, you know Classify the type of attack that we have encountered and divide them into their respective category And and will then use it to compare against the cost to attack versus cost to secure So this is pretty much self-describing. You have you have got the four main types of attack the attacks in hardware The attacks and communication the software components the attack and software components and the cryptographic attacks We also have got any type of attack, which is not there in the list that is a side channel attack If you're not aware of what side channel attack is This these attacks are based on a side channel information that can be retrieved from a device This allows an attacker to measure power consumption voltage fluctuation or other side channel information such as temperature and sound You know side channel attacks make use of some or all of this information to recover the key The device is using it is based on the fact that logic operations have physical characteristics that depend on the user input data So the example of side channel attacks into the timing attack power analysis attack You know fault analysis electromagnetic attacks and environmental attacks as well But on a broader meaning they can be classified into one or more of these So the next slide that we have is cost to attack versus cost to secure So I think this is the same question that I'm this is this is this slide answer your question Let's talk about cost to attack versus cost to secure, right? So security is always about finding out the economic balance Economic cost in balance, right? So it does not make any sense in applying $50 security for the $5 fitness tracker But it makes sense for a $500 smart home equipment and also security is of course also dependent on the Valuable dependent on the value of the asset as well. So a good security architecture also includes the analysis between the cost to attack versus cost to secure Suppose things like communication attacks man the middle and sniffing that cheap to attack and cheap to secure But will this bring and value to an attacker? Yes, but the value is very less Rather the attacker would be impressioning more expensive attack that brings in more values and it makes sense For him or her to spend more on securing those attacks And for and it makes sense for developers to spend more on securing those attacks rather than on cheaper and easier attacks As you move on to the software attacks and not invasive. They are they're costly to attacks And costly to secure but but but this brings more value to the attackers the software attacks like malware attacks and social engineering attacks They've got this cost them a huge effort, but the damage caused by them is also large Similarly the physical attacks on iot device are boss-proving attacks and z tag They are also difficult to pull off at the same time difficult to secure So it makes a lot of sense for you to actually divide your security budget based on these factors and finding a Good balance between all of the components Now let's finally get into thread modeling So thread modeling is a cost effective way of implementing the security in the design phase of sdlc And of course, it's a great way to build depth sake of culture as well So it is a structured approach that enables you to identify quantify and and you know address the security risk associated with an application There are a lot of reasons why thread modeling is important A few of them could be is that it is cheaper to identify and fix the vulnerabilities during the design phase rather than to fix at the production Many other times after production you have a very little or no options left And it's also a great way to proactively identify potential issues and address them at right at the design process and notify the potential issues for developers Thread modeling actually answers questions like what really can go wrong? What should you do when things go wrong? These are these are the kind of questions that thread modeling You know answers This also helps bridge gap between the security and development cycle And is often regarded as a critical step in understanding the security requirement of a system The thread modeling start by analyzing the operating environment Understanding and documenting the ways this device should be attacked This tends to answer questions like what are my most valuable asset? What are the potential threats to my device? What kind of attack is most important for me to prevent at this period of time? And most importantly, how severe are the threats once the device has been developed and ready for production? You could verify if a device has made all sort of security Requirements are not have you addressed all of the threats are not any visible attack surface that is likely to be attacked Has then has this been prevented or not So thread modeling if applied on a sdlc can improve your security posters drastically The other one the other benefit of thread modeling is that you understand the security requirements Suppose if you have identified a thread like like man the middle Possibly that could occur in the apis right? So that could that could give you a security requirement to implement the stdps on production So without thread modeling it is quite impossible to walk on mitigating the threat You'll only you'll only identify the threats after the bridge But thread modeling helps you identify before even a bridge So there could be many standards for building out the you know threat models But one of the very common and widely accepted is Microsoft stride model There are many other models like the vast the great and the octave But we have been using stride for a very long period of time and it works really well with our customers In short you'll divide the threats depending on Depending on what the harm it can cause to this could either be classified all the harms that it could cause Could be classified into either spoofing at the tampering reputation information disclosure Denial of service or elevation of privilege These are the mnemonics for the classification of threats or the classes of threats So how do you build a threat model for yourself? This is a multi-step process that includes searching for threats building differences and eliminating the threats and evaluating the model The first step is to search for threats This is done by identifying the protein cell target To be protected and then defining its boundaries defining its boundaries and external system that it interacts with The next step is to identify the data flows within the target So if you remember earlier I spoke about the CIA trial, right? So this is when it comes into pizza identify the security requirements Based on the potential impact that it can cause on confidentiality integrity and availability The next step is to search for threats. This is mainly based on the enumeration This step also includes determining the known vulnerabilities here You also need to create an attack scenarios and probably play like an attacker The next step could be conducting a risk assessment And also access the likelihood of the attack So if you if you have found out and you know definite risk associated with your IoT application You need to access the likelihood. How likely or how how how do you think it is likely that the particular particular attack could be exploited particular threats could be exploited, right? So once you have identified and accessed all your threat, you need to build differences against it This includes mitigating and eliminating the threats that we recently had discovered The last is that the evaluation of model It is important to determine what is your highest priority or to look back at if you had missed out any vulnerabilities The evaluation model is important. The evaluation of model is important because in a larger team Not one single person will be handling everything, right? So your engineering team will have a good understanding of system, but not everybody The evaluation combines all of them engineering operations and security team All of them need to think like an attacker and evaluate the entry point for the potential entry point of an attacker Trace those path and probably mitigate them This ensures that all the team are on the same path and the team has a clear idea of what's going on in the threads and the possible mitigation So if you are not using threat modeling, I would strongly urge you to do this as this helps you understand the security requirements for your team If you're convinced and interested to learn more about threat modeling For IoT system, I would recommend a talk from Dan Garnel from OASP AppSec Europe 2018 This talk this entire talk is about threat modeling for IoT device And I think it's a must watch for you if you want to implement in your in your ecosystem And also sometimes and also sometimes SARS can help you identify the security vulnerabilities within the device And yes, I'm not paid for it. But yes, we have been using checkmarks for SARS and this works really well So, uh, so I think the counter measures on the application there I think we are in sort of time. Let's let's quickly wrap up this So on the application there, the obvious counter measures are using the strict password policies implementing the lockpot mechanisms And and use widely accepted algorithms rather than building your own, right? So and on on on the application there are vulnerabilities Keep an eye on the wasp top end and have them on your priorities to be mitigated And the vulnerabilities of you know, the first on the list We had was the application there, right? So this includes all the injection issues and authentication issues to be honest Most of the most most of the injection issues could simply be solved by not trusting the user input Most importantly not allowing the unsanitized user input to you know operating system commands This helps you prevent any sort of privileged command injection issues Similarly on the the counter measures for former are that You know always update the former over HTTPS in order to prevent the man the mail attacks And also implement the forced update mechanism with the entire rollback to prevent the critical vulnerabilities Implement the former integrity in order to verify and say if the former has been actually modified by the vendor or not The other common stuff include avoid hard-putting any secret inside the former Whatever component is it one thing you always need to make assumption is that they'll be purchased dissected and studied One of the most common develop mistake that developer make is that they're not studied enough So the attacker the hackers will not be interested enough to in the product to reverse engineer, right? So this is the assumption what makes developers you know stop and hard-put certain credentials inside the former So similarly the counter measures on hardware and Your communications are pretty much given here. I think we're sort of on sort of time. Let's quickly wrap up this So we we had one slide. I think you might be interested in this But I think we have discussed this as well. Let's quickly focus on the best practices for security you know for security, so Uh, so here in the best practices, uh, one of the one of the main thing that you could do is minimizing You know minimizing the exposure So any one thing that you should always keep in mind is that the very moment when you increase the exposure The very moment when you increase the exposure remember that you have opened up the entire attack service for people to Come and attack, right? So minimize the exposure. Try not to you try not to Send the devices with the debug codes in the production by not to you know, Unnecessarily open the ports and leave it off Also for the open for the operating system. Strive the operating systems with a bare minimum Strive the operating system as much as you can to the least that you can right? So this this this will see to decrease down your attack surface And and the ways the attack the attackers could get into your ouch device so um And and and I think uh, there are a lot of best practices I think uh embracing the zero trust policy is one of the very important that you could always do Uh to prevent any lateral entry inside the network even if it gets hard um And and and managing a vulnerability discloser discloser program results very important Uh in in terms of best practices, um, but I think because of time, uh, we'll have to skip this as well There are a lot of best practices and and probably you can take a picture of this slide Even I think I'll I'll be I'll be uploading this slide in uh this guide as well Uh, you can you can take a look at them and probably, you know, uh, implementing your Um and share this within your developers Uh, I think we have come towards the last slide. There are a couple of good bridge and good talks I think you can find them on the internet. That's pretty much for today. Um, I think I think you have launched A lot. I think you have launched something new with this talk and I hope you enjoyed this. Uh, that's all guys Thank you so much for coming in. Thank you so much for attending. Um, and I hope that you all Stay safe and stay healthy. Thank you so much for attending


So, what do transportation, communications, what we eat, and the things we do all have in common? Well, they're all linked together by science and technology. My name is Brian, and one of the things that I find just fascinating is how science and technology influences every aspect of our lives and the world around us. Knowing about science and technology helps us to better understand our past. It can explain throughout our history why there are conflicts, why people go through such great lengths to push new frontiers, and it also helps us to understand the interconnectivity of the world around us. Although the history of science and technology is fascinating, it's important to remember that it's constantly evolving, so understanding its implications allow us to better understand how science and technology influences the present. When we examine how much science and technology has changed throughout the course of human history, it gives us an idea of its great potential and the hope it holds for the future. My name is Brian, and if I can be a National Science and Technology Week Champion, then so can you.


ligations that are associated with land? Or, as I think the balance of the evidence in the previous panel was, that it could properly and adequately be provided simply through the website of the Forestry Commission Scotland or its successors. Charles, I'll let you come, and then I think Malcolm, I suspect that you may have views on that, say, Charles. I will hold my hands up and say that when we read it in the bill, we thought registers of Scotland seemed like the right place for it. I have to admit that I didn't think through the consequences in listening to this morning's evidence. I'm now in two minds that, perhaps, it could easily be done through the Forestry Commission. It could certainly be done more cheaply. I wouldn't want to present myself as saying that we are absolutely tied to what's in the bill. If there was an alternative such as doing it through the Forestry Commission's existing IT system, then I would be quite happy to look at that. It should be—let's not necessarily use a capital R on the word registered, but publicly available to be seen. Absolutely. It's a principle of public register. However that is delivered. I agree. Sorry, maybe Malcolm's got the experience of how that works at the moment, and maybe you could explain that, because I think the committee would find that very useful, because it seems to me quite a simple system. In the past we used to have to send out a licence to somebody if they wanted some data. We have, as part of the open government approach, we have moved to publishing as much as possible as we can online. The Forest Enterprise, for example, publishes its entire subcompartment database online. You can get it, you can access the sites. He's a developer, you want to look at it, you can do so. The Forestry Commission does exactly the same with all the constraints, so Woodland Grant scheme, the old—everything is there, it's unavailable on a publicly available website, which is maintained and updated by, I'm assuming, my colleagues in the Forestry Commission Scotland. Other data like SNH data is brought in. It's just gathered into one repository where it's publicly available. I would also point out that registers is quite busy at the moment. They have to register everything supposedly by 2019, which is an absolutely mammoth task, which would be very interesting to see if they achieve it. Ma gam, can I just—sorry, I'm bringing Stuart in there for a minute—could you just expect—is it very easy to access that database? Sorry, Stuart, you wanted to come back. I'll meet my point first and then Maggie can pick it up if she needs to. Ma gam used the phrase, as much as possible, and I just slightly worry about that. Does that imply therefore that it would be helpful if the bill were to take a different approach from registers of Scotland, where at least the bill should specify what information would have to be published, so there'd be no ambiguity about the respective responsibilities of all the parties? I think any obligations need to be published. If there's a constraint that we're aware of—obviously, there may be some things we're not aware of, which we can't be expected to publish—our approach has just moved to open government. It costs us far less to put it on a website than to have somebody ring up and say, can you supply me with a section of such, and then somebody does the same thing the following day. That's why I did it with all the renewable stuff. Maggie, do you want to come in? It was just a very brief point with my Scottish Wildlife Trust hat on that we have planning volunteers who regularly use the excellent website. If this information was there as well, it was all in one place. I have to say that I was found it quite easy. Charles, do you want to— No, I agree that it's a very easy website to use. I would recommend that you all have a look. I may move on to the next theme, which is, and the last theme, which is Jamie Green to introduce. I would like to close to discuss the financial implications of the bill. Two short questions. I'll take them separately. The first one is around the budget lines for FCS and FES, which at the moment are separate and come with their respective separate accounting, reporting and audit functions. One assumes that these will be assumed within the new—within the forestry directorate. I wonder if the panel had any concerns around that, but more importantly, if they have concerns, what do they think this bill should include to address any concerns that you have? I strongly object to the proposals. I've made it very clear that we feel that our staff will be greatly at risk if the structure that is proposed comes about. Officials have used, in evidence sessions with us when we have met the minister and the officials and with yourselves, the fact that we have two separate sets of accounts as evidence that we are two separate organisations. I hope that I have been able to show this morning that we are not two separate organisations that we work very closely together and that we just have accounting arrangements that demonstrate that we spend this bit on FCS and FES, and we have audit appropriate. If this is separated out, others have made comments that there is no then accountability on what the Scottish Government spends on the regulation policy side. Our case is entirely consistent that this needs to be a separate organisation that is fully accountable and fully transparent. We would prefer it to be a single organisation with both parts in it. I think that you are putting the part that we raised. I suppose that it's whether we can think of some amendment that can go on the bill or whether we get a commitment when the minister is sitting before the committee next week to talk about assurances over how the spending will be scrutinised, how the Parliament can scrutinise it, and I'm not quite sure as yet thinking about it, but we will think about it if it's something that can go on the bill, but in the meantime you could ask the minister how it's a valid point and get it on the record as to what he's thinking is behind that. As was raised in the previous session in terms of the restructuring in organisation, if it takes away from optimising the asset of Scotland in terms of woodland creation, woodland restoration, native woodland creation, then we wouldn't want to see that. Even if it is a short term, it's probably going to be quite costly. It's a great irony that a bill that sets out to try and increase accountability and transparency is, through I'm sure an unintended consequence, removing a great deal of transparency in terms of the funding going into the two operations of Scottish Government. In terms of how you fix that, it shouldn't be too difficult, it's about reporting and accounting. Our requirement on this particular division to provide full accounts to Parliament are something along those lines. I haven't given thought to that, but that's your guy's job. Willie, do you want to come in? I would endorse the chances point and Malcolm also in terms of the structure. I don't know what you're not going to ask about IT and rebranding as a follow-up. Sorry, why don't you bring that in now, Jamie? Perhaps you'll get a chance to answer that. I mean, it's similar to what I asked the last panel. I mean, there is a bit of a mixed response, I think, last panel, as to how important this was. I mean, the costs could range from estimates between £6 million and £12 million. It's still a substantial amount of money, which I get the impression will come from existing forestry budgets, as opposed to new money that's been introduced by the Scottish Government. I want to hear if the panel thinks that whether the Scottish Government should fund the cost of this restruction, which at the end of the day is a political decision to do so. Short answer, yes. I think that IT, somebody mentioned ARPID, and there's a few of us sitting around the table that use these systems to get access to grant. I think that they should not go anywhere near new IT. And rebranding over a number of years with the same livery, but perhaps a different play on the words, would mean that you didn't have to spend a lot of money getting white vehicles or going round Scotland's forests, changing all the signs. Sorry.  I mean, what we've heard this morning from people is the high esteem that the Forestry Commission Scotland is held in, and how the fact is fairly well integrated. So, before just accepting rebranding, are you saying that it needs rebranded or not? No, I would not restructure or rebrand, but as a sometimes fatalist, if it were to be the case that the decision was to do such a thing, then doing it in such a way to maintain the colours and verbiage such that we're not spending four to whatever million pounds it is on, which could be spent better elsewhere. Okay, so this seems to be a good way to wrap this up. I'm going to just go straight down the line, if I may, and give you all a chance to answer the question, does it need to be rebranded, and where should the money come if it does need to be rebranded? So, Charles, perhaps you can… Well, although I would never call myself a fatalist, I agree completely with Willie, that our original position that this doesn't need to happen does away with all of these issues. One of our initial responses to the consultation was that the Forestry Commission is such a strong brand and it has such a great reputation that it's a real loss to Scotland to lose it. My understanding is, of course, that in England they will maintain the Forestry Commission ban. They will be Forestry Commission continuing, but that makes me think that maybe we should adopt a sort of yes Scotland approach similar to what they said about The Pound, is that it's our Forestry Commission too and we've got just as much right to use that branding and continue along those lines, but I've not heard any appetite for that approach down the line. In terms of taking a fatalistic approach and if it's thrust upon us and we have to do it, then I would not want to see any money transferred from operations on the ground into IT or new signs. If it detracts from putting one tree in the grounds, then I think it's done a disservice to Scotland. Malcolm. The process, as I understand it, is that the brand is owned by Forestry Commission and as such belongs with Westminster. Consequently, if you split off, you don't have a licence to use the brand. We are currently talking about what happens with forest research. We haven't asked in this particular panel, but the management of forest research looks as though it's going to end up by retaining remaining as part of an agency of the Forestry Commission England, which will then end up by being able to use the brand in Scotland because we have a branch of our research establishments at Northern Research Station just outside Edinburgh. We're then proposing that the Forestry Commission in Scotland moves out of that. If negotiations can take place about the cross-border nature of forest research, I don't see it as being terribly difficult to come to some agreement about the use of the brand. I really can't imagine that Westminster is going to dine a ditch over it. So I would say we have no need to change the brand. We could make some minimal changes. We've suggested here Forestry Scotland rather than Forestry Commission Scotland, a very minor change, but it's about keeping the two parts together is the important thing. On the subject of the actual money, there is an element of IT investment that is required very definitely in the organisation with a lot of uncertainty around we have perhaps not spent as much as we should have done, so there is some investment required in IT. Moving to Scottish Government with their facilities that they already have could be of great benefit to us and that will require some investment, but spending that much money on the rebranding is a complete waste of money and will not go down very well with your constituents. It is, as others have said, it's a severe threat to our staff. The requirement is whoever divorces pays the bill. When Wales left, they had to pay the bill. When Scotland left, they have to pay the bill, but actually all they've done is they've transferred to the Forestry Commission and said you pay for it, and that is a severe threat to our staff. Thank you, Malcolm. Maggie, could I ask you— Very brief, yes. I think that the main thing is, as I said before, money shouldn't be diverted from the activity of forestry and delivering sustainable forest management through a new brand. If we could keep the same name, it would save money. David. I'll start with IT first and then brand, if you don't mind. The comment that I was going to make by IT was just that, although I understand why lots of reputations can be damaged by lots of things necessarily not working, but looking forward, whatever the information technology that's going to be required, that will require continual reinvestment to be contemporary and leading edge for managing best part of a fifth of Scotland's land, if you were to take all trees in me. What I'm saying is that we shouldn't leave by reflecting on the lack of investment in what is going to be the underpinning infrastructure for the efficient management of the system, and where it comes from wouldn't be for me to pick up. On the branding, it seems to me that it is really important to try and keep the goodwill and the name, and the colleagues here have expressed that really cogently. The question in my mind is, given that we are touching on 100 years of the commission, what should the brand be in 2117 with the generations going through? Will it be that the generation coming up and using and benefiting from those forests will associate with Forestry commission or Forestry commission Scotland in the same way? The dialogue, the debate and the consultation could be what should that be for the current generation and that for the next 100 years. Again, the payment for that I'll pass if you don't mind. Thank you very much all of you for the evidence that you've given this morning. I think it's been very interesting and we've certainly learned a lot on Forestry and the passion that you have spoken with actually has come through. Thank you very much. That actually does conclude this part of the committee's business. Our next meeting next week is on the Island Scotland Bill and we'll be taking evidence from the Cabinet Secretary on Forestry and Land Management Scotland Bill and the Small Holding Bill and we'll be looking at a budget approach, but that concludes our meeting today and I would like now to close the meeting. I would ask committee members please to remain seated briefly for a session afterwards.


Hi everyone, Joe for jaspyscasebrakes.com coming at you with 2022 hip raid jaspy exclusive Multisport random player break number nine. You can see the next case is already loaded up So we're the number nine second to last case next break already in the store jaspyscasebrakes.com our last case So still some chasers I don't know which ones have been pulled or haven't been pulled But some of these chasers are still out there. I'm sure in the last two cases Here's the full list of players right here basketball football soccer baseball good spread of players Big thanks to this group for making it happen. We planned on two fillers, but the full spots were moving quickly We ended up only have to do one filler that prism 2014 prism 16 pack number 16 Congrats to the winners and thanks to the people who bought their spots straight up There's all the players right here and let's roll it randomized names and players four and a three seven times each one two three four five six and Seventh and final time After seven we got Brian with the spot that he won a down to Mickey with the full spot that he got No matter how you got in I appreciate it four and a three seven times for the players one two three four five six and Seventh and final time after seven. We got you're done Alvarez all the way down to AI the answer All right, so here's how it shakes out Get a swig of water here Brian with you're done Alvarez Eric with Joel and bead Hyrule with Jamar Chase Brian with Anthony Davis Hyrule with the one solo Brian with Dubrunia Judson with Mack Jones Daniel Justin Fields Greg with Hyunmin Sun Hyrule with Kyler Murray Daniel with Jonathan Taylor Brandon with Christian R. Ronaldo Eric with Aaron judge Bernice Christian Pulisig Brian with Justin Herbert Daniel Jordan pool Chase Jalen Herds Conrad Mike Trout Tristan Nolan Ryan Philippa with Shaq Shaquille O'Neal Brian with Jalen Green Eric with Fernandio to tease junior Jason K with Kevin Durant Brian with Albert Pujols Brandon with Anthony Edwards Hyrule with Ronald Cooner Jr. Jazz with Wayne Rooney Nestor Jalen waddle Hyrule with Joe Burrow Brian Aaron Rogers Colin Scotty Barnes and Mickey with the answer We're gonna alphabetize by player name here and we're gonna pause the video when we come back We're gonna see if there's any trades and then the break stick around BRB All right, welcome back everybody a little bit of trade chatter, but ultimately no deals were done Here on Thursday the 12th 2023 Thanks everyone for making this happen. The last case is in the store Jaspy's case breaks calm. There it is Jaspy exclusive multi-sport edition Thanks hip parade For helping set all this up. Let's see what we got in here at first one out of the gate Is gonna be the baseball player Yeah, it's Ronald Acuna Jr. 56 out of 99 Like that shadow box look there franchise best autograph from 2020 tops tribute baseball nice That will be for Hyrule with Ronald Acuna Jr. Next up. Yeah, the tribute is nice You try to dig up some old tribute and put it on Gasky's case breaks calm another one We have a basketball player and That is Alan Iverson Nice from an old tops finest basketball set 47 out of 65 nice Alan Iverson and Mickey there you go Mickey there he is Mickey with the answer talk about practice Not a game Not a game not the game that he would live and die for Talk about practice. We have here. We have baseball We have Nolan Ryan 1968 rookie stars autograph Nice and certified autograph issue stamp right there as well Tops legend stamp on the other side nice. Look how young he looks there that goes to That goes to Tristan and the Nolan Ryan spot next one It's got a panini sticker on it looks like it's basketball a redeemed redemption It is oh wow 2225 rookie patch auto Joellen bead that's nice Who's got the Embiid spot Eric with the RPA? nice There you go Eric with the Joellen bead spot Yeah, this is a team break the six root beat killing it All right next up is we got NFL We got some football now We've got some Packers. We've got MVP Aaron Rodgers 14 out of 25 from contenders football And 2020 contenders football That's Brian with the Aaron Rodgers spot discount double check. All right final one Remember the last case of this Jaspie exclusive in the store right now Jaspie's case rates calm All right final one We've got some soccer So there's a multi-sport product Whoo all-time legends Wayne Rooney five out of ten my rival is Manchester United That's jazz With the Wayne Rooney spot. I think is now back with the DC United In a coaching capacity. I want to say you played for them for a little bit, too He's got some great highlights as a DC United player check those out after you watch Jaspie's I'm Joe for Jaspie's case breaks calm Let's get into the last case go and get it and I'll see you next time for the next one. Bye. Bye


Hello and welcome. We're coming to you today from the most polluted city in the world. But that's not what we're talking about. We're talking about football. More specifically, India's upcoming international friendly against Jordan. And discussing this vital, vital issue with me today is a man who you know as the rising star in the star sports presenter's table. I know him as a man who can eat his way out of any situation and the finest midfielder to never have played for India. Mr Arjun Pandit. What's happening buddy? That was a very good introduction. I wasn't expecting that to be understood. The best midfielder part, you had me at best only. Where are you coming from? We're coming from Chinnai where the third T20 international was played between India and the West Indies. And it was a good game because David Silva scored a good goal. And then Maa Siyal got the equalizer but then I was happy because I don't like United that much because we're Arsenal fans. I had no work so I was watching the Manchester Dabi. So, leave Manchester Dabi and talk about your Dabi. See the game against Jordan in first and foremost, I think we should put our hands together for the AIFF that in the space of a month, you've got the Indian team playing two games against really top quality opposition. First came China and now comes Jordan. Give credit where credit is due. Because these are the kind of games you have to play before the Asian Cup. You will get the opposition in the Asian Cup. There's no point playing versus Sri Lanka, Pakistan and so on and so forth. There's no disrespect intended to them. But Jordan in my view will possibly be the closest we will get to playing a team like Bahrain. If you remember 2011 Bahrain when we played against them, they were tall, strong boys, big guys, six feet tall. A majority of them, their average height was about six feet tall and all. So, I'm guessing Jordan is the closest to that. So, it's going to be a very physical encounter. And as opposed to China, it will be interesting to see the way Stephen Constantine sets his team up. Let's be honest that the team exceeded expectations. No one was expecting them to play the way they played against China and it didn't seem like they were shooting in the dark. They had planned for it and they executed his plans beautifully in China versus Jordan now we will have to see. Because in team news, this is what is being heard in reports is that team captain Sunil Chhetri might not be playing this game owing to an injured ankle. Which if the reports are true, then it's a good decision because you'd rather have him fully fit come the first week of Jan as opposed to now versus Jordan. But yeah, so it's been an interesting game. How much of a difference do you think that makes irrespective? Because we had this situation and the reports also indicate that Chhetri's injury is not serious. So hopefully this is just a precautionary measure and nothing more than that because that's a 2011 we were talking about and Baichung wasn't at his, he had the recurring injuries going on. But the minute you saw him come on to the pitch even against, was it the last game against Korea? Yeah, he came off the bench. And like Baichung comes on, boom he came on, full power. But more than him, the transformation that the team went through the minute this guy came on to the pitch suddenly is like there was a new energy and a new sort of sense of purpose about these boys. Suddenly they thought it's possible. Our biggest player has come on the field. So do you think Chhetri is in a very similar position with the current national team? Of course, Chhetri is way ahead of any player in this team and I mean it with the utmost respect for every other player on this team. What Chhetri has done and what Chhetri has done consistently over the years and what Chhetri has been doing over the last two years is not like Chhetri is walking on his name. He was the standout player in the ISL last season, Indian player. He is the standout player for Bengaluru this season as well. He's already got I think four or five goals to his name. The injury was also after he... The injury was also after he scored. He played the full 90 after that and I'm guessing after the 90 they assessed his injury and Bengaluru said look thoda issu hai and I'm guessing they were in contact with the All India Football Federation who of course were in contact with the coach and then if they've taken the decision to rest him then you've got to welcome that decision.  He did not recover from his calf but Bhaichung did not have was the professional approach that the ISL teams are giving to their players. They're giving him... And this boy is at his peak now. He's at his peak right now. He's playing like he's... But it's also his last big international tournament. Yeah for sure. I mean we're not going to the World Cup. Yeah. So yeah, I know. But you know what this also means is that since there's no Chhetri it means there's an opportunity for the likes of JJ and Balwant Singh to stand up and be counted. But as they say with goalscorers that in the build up to a game your form defines the kind of... You know the kind of momentum you're carrying into it and momentum for a goalscorer to have that touch to have that feel for a goal is so important. JJ has not had the best of starts to the ISL Balwant has not had the best of starts with ATK in the ISL So my only worry is that where are the goals going to come from? There's not going to be much of a chance. Udanta Singh has not had the best of starts to the ISL No goal, no assist to Udanta so far in Bengaluru FC's campaign The only guy who seems to have had a decent ISL is Holly Charan Naziri But Holly Charan Naziri playing international football is a completely different scenario as opposed to Holly Charan Naziri playing in the ISL Pranoy Haldar is a good midfielder you need someone like that combative midfielder he's shown that in the ISL Raul and Borges man Raul and Borges used to be a mainstay for Stephen Constantine up until about a year and a half back he was probably one of the first few names on that list he's come down the pecking order but he's had a good start to the ISL again last season he was injured so didn't have the best of seasons this time around the Raul in of old has come back in Anirot Thapa his team has not had a good season but Anirot Thapa as we saw in that game was China brings in freshness into that midfield he brings the air of positivity, his ability on the ball so that should be good but the big talking point for me is the defence Anas he is a a two-stopper back Sandesh and Anas of course Anas hasn't featured in the ISL so far so he's practically going into the game versus Jordan with no real game time under his back damn no match sharpness no but he has this sort of connection with Sandesh I suppose the idea is to if he's not the national team coach can have no real say on what his ISL team does he can at least give him game time when he has the chance yeah but you can't say there's not is not going to have an effect or a factor on the way he plays for the national team because if you're playing five games prior to that with the club team then you come to play one game with the national team of course what you do in those five games will have a big impact momentum is huge in football your rhythm everything develops over time now the big question is really do we have when did Anas come back from injury also he hasn't been fully fit for yeah he hasn't been fully fit for a while he didn't start the ISL he had an injury yeah I think it's been a while since he's come back to full fitness actually but the big question really is do we have a reserve pool right this close to the Asian Cup do we have a reserve pool of getting in new players and saying okay maybe these guys are not in full form for their club teams should we get players are doing well for their club teams and bring them into the national team and my answer is no you don't you're practically two games away from the Asian Cup you've got your 30 man squad ready you can not bring in new players now which means if a Suasai Raj is doing really well for Jamshedpur FC I'm sorry but he just does not fit the scheme of things now it's too late now you can't do it now if this was six months then maybe you could have said okay Suasai Raj if Suasai Raj was playing the ISL last season and he performed the way he was performing for Jamshedpur then yeah probably you would have seen him in the 30 man squad but because he was playing the I-League last season then you had to see him step up and see whether he could do it in the ISL and now that he's doing it but it's too late here it's just a timing and issue I think so I don't think you can bring in new players yeah this I mean like so we can of course a separate discussion is on whether the ISL is actually a step up or not I think like if you see the quality of a player especially a young player 22-23 year old player who is playing the way he was consistently over the course of a season against big teams, small teams all kinds of teams like Suasai Raj is last season I think there's enough there for a coach to say okay why not give this guy a shot see what happens next season next season so anyway but what's what's done is done what you're saying is basically team Paki team Paki is done now there are only 18 or 20 boys in the squad for the Asian Cup now you just have to pick and choose who is my best player in form right now and I think in his mind he's only chosen his 18-20 man squad he's just going with 30 because you get the option to bring these boys and you can of course see them in practice and it keeps the others on their toes as well so it works that way to your other the other league point my thing is just that I think neither or no league competition no club competition in India is of the standard where like you can really take those performances into serious consideration when it comes to the national team playing like the Asian Cup agreed agreed so it's pretty much like the coach has no choice but to go with what he thinks is will be the best 11 he can put out that's fair enough but the thing is see whether or not you agree with me if the ISL is the best quality of football in the country even if you're not Stephen Connolly you're any coach you're going to choose from that talent pool that you have playing in the highest but the sort of the competitive fixtures for them to prove that they are good enough to play at the higher level I mean like you're saying if I were the coach, if you were the coach you'd go with the guys who you trust and who you've built into some kind of a unit and the unit has been performing for a while now so that trust factor is there it's not like stopgap, stopgap sometimes you're losing sometimes you're winning sometimes you're losing they put together a good run of wins and after that performance versus China it's kind of validated a bit as well so now will the same thing happen versus Jordan? I don't know because Jordan could be a completely different approach and if you go on to the field without Sunil Chhetri by the way are you going to break the news to us first? is transport showing the game? is that already decided? last time it was like a last-minute decision that 3 billion potential sort of audience match it's time to show it are you showing it too? next question sorry, go on no, but no my point was just that I think it'll be a real test for us to see how we do without Sunil Chhetri I think that is the big, big talking point and how this team manages without Sunil Chhetri someone like JJ steps up because JJ's full-scoring form has been on the vein for a while now it's been from last season of the ISL and it's carried on into this season as well and especially when you have Chhetri in the form that he is you can still sit back and say okay, I can be provider you know I can provide I can play in that triangle for Udanta, Chhetri and JJ but if Chhetri is not there now Balwant will come so Balwant, JJ and Udanta how will the combination go? we'll have to see that because all this while we have not taken into account what if something happens to Sunil Chhetri it's been 34 years and I mean it why are we jinxing? I'm not jinxing I'm a touch wood I hope nothing happens man we know him personally also great guy, great player but what if something happens to Sunil Chhetri then what will you do? then are you depleted completely? are you depleted completely going forward? we'll see I mean I definitely think it makes a massive difference he is the best player but he has that Baichun effect like you said he has an effect on his team mates more than his ability on the ball his brain is fully there he's always I mean his work rate is phenomenal there's literally nothing about the guy that is that takes away from this Indian team but that said I think with nothing to lose also a guy like Balwant whenever he's gotten a chance for the national team he's gone and done something he's gone and done something so what do you know Mahade 35 yard cracker it's going to be fun yeah but I'm just saying that he has very little probability because the striker the striker runs on his momentum now if both of your top strikers within the first few games of the ISL I think 5 or 6 games they haven't done much and you define a striker of course you look at the striker and you see his work rate and you see how he's combining with the team and all but the ultimate definition of a striker is through the amount of goals he's scoring and both of them have not been scoring too many goals agree agree so that's an issue yeah it's like my take is just that in this case for these guys like the playing for the national team a lot of things change yeah overall like the cohesiveness of the team the quality of players in every position I mean in a small pool of players the national team here represents overall much higher standard like these 30 boys if you were to make a club side out of them and play against even the foreign players who are currently playing in India I think they would do alright so it's safe to say that given that situation and improvement in performance of course you have to also consider the fact that the opposition is far superior so it could be that these defenders and I frankly I don't know Jordan so well that I can comment on whether against those specific defenders whether Balwant or any of these guys actually have any chance at all yeah so but you brought up Jordan just for the people who are watching what is the team made up of how many European players how many players from the local league there's one young player a guy called Moussa Al-Tamari Moussa Al-Tamari yeah he's 21 years old and he's playing at Apoel, Nicosia and Cyprus which is a club it's a reasonably big club Apoel I think plays so I guess he's the biggest talent the rest of them are mainly from two clubs Al Faisali and Al Vedat between the two of them they've almost won like 50 league titles domestically so most of the players are from these two big clubs the Dabi of Jordan clubs also I think Jordan their last game was versus world cup finalist Croatia 2-1 they lost but since we keep focusing on the last game I think it's very important to focus on what they've done over a long period of time so over the last 10 games they've played three European opposition so they've played Croatia they've played Cyprus and they've played Denmark and this is not the one game, two games it's come over a period of 10 games in between they've played Asian opposition so you're playing a squad which is well oiled and which is sorted seasoned squad so I think this is going to be a obviously they are planning for like I guess they are looking at the Asian cup as a maybe potentially winnable competition or looking to get to the last stages maybe so their preparation has to be but I don't get it I'm going to ask you what do you think China would have been a tougher test or Jordan is going to be a tougher test and don't take into account what we did in China I'm just saying on paper if you would have been seeing that India is going to China to play China and then to Aman to play Jordan which for you would have been a tougher test both tough games I don't know how we can compare but like the Chinese men's team hasn't done anywhere close to as well as the Chinese women's team has done and somehow because of the I guess the positivity there is a positivity associated with how the national team is doing right now right not too many defeats it's a there's a belief I think that against most opposition they can put in a good effort whatever happens China also I mean they cracked the bar a couple of times it's a game we should have lost we might have lost on another day this will be a similarly tough situation I think there's going to be a tougher test I think planning needs to be improved you thought the plan was well executed I thought like to the best of our abilities yeah perhaps to the best of our abilities that's what I'm saying you can't execute a plan over 90 minutes but you can execute it for say 60 minutes for patches of 15 minutes football is the same sometimes you have momentum of 5 minutes sometimes they have momentum of 5 minutes it's what you do when you have momentum on your side or when your backs are against the wall that's what counts everyone knows how to trap the ball everyone knows if it goes in I will overlap we also do that it doesn't mean that we can execute in a match situation it's a completely different scenario so that's that and then after this is one game definitely like I'm sure the crowd in Aman will be like really pumped up yeah I think everyone knows now it's pretty close to the competition it's going to be a fun game definitely should be a good game I'm looking forward to it so for you the couple of Indian guys that you will be watching particularly and hoping that they fit into the system for the betrayal of Balwan, J.J. and Udanta how they function without Sunil Chhetri that for me I'm going to have a keen eye on the defense just not because something new is happening but just how they can continue that consistency that they've been showing at the international level and like in the last game versus China I saw it was not hard badaane wali defending you know ki ball aaghi uradia main a bangladesh yam aadia main a shillanka it was you know Sandesh was coming into his own he was taking over the player one on one situations he was sometimes getting better of the Chinese players and all so it remains to be seen if they can do the same versus a physical physically strong Jordanian side different strengths different and of course with the kind of performances he's been giving over the past couple of years you've come to expect a certain kind of performance from him so you'd hope that Gurpreet continues doing what he does and really it's just I want to see the kind of tactics they imply a man is it going to be the same thing of baal mili counter pehbhagav 1 2 3 touches triangle peh and move forward because mind you Jordan would have seen video of the game versus China right Jordan would have seen video of the game versus China and China did not have the benefit of seeing a game that India played versus tough opposition like them and to see the kind of opportunities and the kind of tactics they employed so if anything I think Jordan will be prepared for that and if that happens what sort of a pragmatic approach does the coach use during the game and does he have you know the bandwidth does he have the kind of players with the tactical know how to change their system during a game that is what I'm going to be looking at here of course goal but I don't know I think the goal seems a little bit difficult hmm it seems a little bit difficult like our white hair from here it's going to be difficult I think the goal seems a little bit difficult and on this scientific note on this scientific note put on the dial put on the dial at least one camera person who is going to sleep we'll take that as a pointer and wrap up this discussion we'll we'll do it again and the next time we'll be talking about the tournament the atmosphere of a major tournament hopefully Mr. Pandit will join us again we're not reviewing the game we'll review the game but let's see how it goes first if it's a 7-0 type scene then let's skip the review okay don't think it's happening with 7-0 man I mean that's that's negativity right there for you yeah I don't think it's happening either I don't think it's happening either I think it'll be oh let's go prediction score prediction I have forced people all my life to predict because the nature of our job is that journalists sir prediction it's the most stupid question ever on the planet I feel sorry but since you're asking me for a prediction I'll say stupid is a stupid does yeah I'll say it's a Jordanian win I can't give you a score man I don't know I think Jordan's going to win this but I'm not bothered about the result like I said after China also I'm just bothered about the way we play and what we do yeah sir prediction sir I think it would be great sir if we could get a goal I think it'll be a massive boost that's a the rest it's going to go on the weaknesses will remain over the course of 2-3 games it won't change but if we get a goal at least we'll get a little confidence I think it'll be a step forward I think one more thing I remember we got a chance to play a little bit there because in the ISL also I was seeing a couple of games of Delhi Dynamos yeah that boy looks transformed there and transformed not because his game has changed there's a certain amount of self-belief that has come into himself that he knows that I can take on players physically he's really worked on himself you can make out he's buffed up a little bit he's become a little broad and he moves well with the ball I think maybe I'm not saying Chante should be starting for you Follicharan Naziri has been your main guy then you start with him but give him 10 minutes give him 15 minutes 20 minutes and let's see what Chante can do because if he's a part of your 30 man squad then he deserves to be given a chance he's even doing so in the club yeah let's see what he's got alright Mr. Konstantin it's on you now sir yes sir we'll be watching thanks for joining us we'll see you again I don't think he'll be watching