Welcome to my program, Elder Hood, Aging Gracefully. I extend you that lo-ha experience of Hawaii, that beautiful concept of welcoming people into the company of the whole family with sharing one breath and one life. And I don't know all of you, but like one famous author said, all of you are just friends I have yet to meet. So thank you for coming and being a part of this on-show experience. I'm looking at Elder Hood, Elder Hood as a stage of life.  And now we have a stage called Elder Hood, I like to say. Elder Hood, I want to offer you as an opportunity to, with my coaching and with other resources available, make that experience of life real and wonderful. I've approached this Elder Hood, and I'm grateful for Think Tank Hawaii for giving me this opportunity to share it with you. But I've approached this stage of life as having five tasks that are called spiritual tasks. Those spiritual tasks beside me here are grieving, sorting out our stories, forgiving, and letting go. And each one of those has some depth to it that I'm exploring here on these programs. The preparing piece, usually when we talk about preparing, of course we look at the externals. And I'm going to look at those with my guests today in just a few minutes. Some of the externals that are available, the resources that you want to look into to learn about what Elder Hood can be and will be when you make some positive, health-affirming choices. There's also an internal dimension to preparing, the internal dimension of imagination. What do you imagine your Elder Hood to be? If you imagine your Elder Hood to be, some of the old stories that we have had, a decrepit, loss of everything, abilities, if we imagine that's what we're going into, we very likely will make that happen. I'm not saying that imagination is everything, but on the other hand, if we think of it as capable of being wonderful and full of health and well-being, then we are very likely to find those resources and to incorporate them into our decision-making and create a new story for us. Two weeks ago, my guest was Mary, from Los Angeles. And Mary talked with us about the different stories when we get into this time of life. They bring with us stories from the past, which often are stories like, I have to be fat, I have to be big, I have to... Everyone in my family has diabetes, I'm going to have diabetes. It goes on and on of the stories that we tell ourselves and sometimes inherit. I said to be careful because every time you hear yourself saying, I'm always, that's a story. It's not a reality, it's the story. And you can know what your stories are just by listening to yourself talk. I also told you that two weeks ago, I was going to start a new program of health management myself. And part of that, the first piece with my coach, is weight loss. And you probably can't tell, but I've lost five pounds last week. Which is an important part of my new journey. I only have 55 left and I'm going to make it. So grieving, sorting out our stories, forgiving and preparing ourselves. Preparing for an elderhood and for a life at the end of life full of meaning and significance and wonder. This is our opportunity today. And I've likened this to two different kinds of ways of landing an airplane. I came in to land on an airplane in Asheville, North Carolina, over the Blue Ridge Mountains. And the pilot came on and said, we're over thunderstorms. I can't just go through the thunderstorms. We're going to circulate up here above the storms until I find an opening and then we'll go in. So we were there 10 minutes, came online and said, OK, I got an opening and I'm going in. Well, he didn't just take a gradual approach. He dove through the clouds and everybody was a white knuckle. Everybody was a white knuckle experience for all of us. As he plunged to the earth and plunged to the landing strip. That's how many of us are planning to end our lives eventually. We'll think of ourselves as being above it all. No problems, no problems, even though there may be difficulties that we're in. We're in denial. We are in ignoring the facts of what was before us sometimes. And then suddenly there's a plunge and everybody grabs their chair and goes, what has happened? We didn't anticipate this. And that's exactly right. We didn't anticipate this. The other kind of approach in elderhood seems to me is like landing in Honolulu. You start off way out over the ocean and take a nice gradual, easy approach to the landing strip. Plans are made. You strengthen yourself all along. You get the resources together like I'm going to do to lose weight, to become healthful instead of following the old stories that may oftentimes lead to our dis-ease with ourselves and with our life. There are so many amazing resources. We have 250,000 residents in Hawaii, over 65, and that's about a quarter of the population. But that's a lot of folks. Fortunately, that has provided impetus for us to have a lot of resources available too. And I'm wanting to introduce you to one of my colleagues from Bristol Hospice, where I am a chaplain serving as a chaplain. And Erin Hamilton is the director of community development. And I'm so grateful to welcome her here today. Erin, thank you so much for coming. Thank you for having me. You're welcome. And I love what you were saying about how perception is kind of the basis of our preparations in life. Okay. Good. Well, Erin, would you just share a little bit about hospice care to start off with? Bristol Hospice, I say, and because I have a great affection for it, is a company that I'm proud to say lives out its tagline, which is embracing a reverence for life. And I think we do that. Tell us in general about the benefits of hospice care. What do you see, and when you go out to meet with people, what's on your mind to say, why is it important that I would even consider hospice care at this stage of my life? Of course.  And then preparation. I think the biggest thing that we struggle with when we get into the field and when we typically are getting a hospice referral is going to be, it's a late referral. So unfortunately, a lot of the time we just don't want to facilitate these discussions with our family members, whether it be cultural beliefs, or kind of just if it's a taboo subject, which I feel like it kind of is for us. You're saying even hospice, talking about hospice care is taboo? Yeah. So I think definitely nobody wants to kind of talk about that, you know, that elephant in the room or the gorilla in the corner, and especially now that we have a lot more medical advances, we're doing a lot more treatments, you know, it's important to be hopeful, but I think it's also important to kind of just talk about all possibilities and just be prepared for that as well. So, you know, one of the things with hospice care is not only preparing the individual, but as well as the family and giving them support too, like yourself.  They have their attending physician as well and a physician from the hospice as well. Their medical equipment, their medications, that's all a part of it, and it's just what we all paid for, like when we pair Medicare taxes, that's where it's going. And I think a big part of that perception is number one, we don't want to talk about it because it's kind of taboo, or we don't want to offend or give up hope, but at the same time, it's important to kind of acknowledge that we're all getting that same ticket to that same place and let's just try to embrace, like you're saying, the reverence of our lives. And I'd like to say, Tag, Ride the Cotales is one thing you said, which was having the family together, and we have a, it's a great advantage to us and to the family when we can bond with the family earlier in the process of that dying process, the eventual dying process and really walk the journey alongside them rather than wait until they suddenly land in our laps and they're frantic, the family's frantic, the patient's frantic. What's the first prescription for being eligible for hospital hospice care? The first prescription or... Six months. Yeah, so they would definitely have to have a terminal diagnosis of six months or less by two physicians. Typically it's going to be the referring physician, the specialist, or the... Two physicians. It would be two, and then usually our physician, the hospice physician, is that second certification. But that's nothing usually, that the family's usually, or the patient usually has to worry about. It's really just kind of taking that leap and let's just talk about this because it doesn't mean that you're giving up hope and there are, as we would say, hospice graduates, which you kind of know about. And those are going to be patients that maybe do get a little bit better and they are able to get off services and maybe pursue a little bit of treatment that they were willing to or wanting to pursue prior. Or maybe they gained a little weight or their functional ability is a little bit better and then they can always come back onto hospice services later on. So if we have a chance to bond with that family right at the beginning of getting that news, six months out, there's a death, imminent death, probably in six months. We can bond with them and walk that journey. We can bring all these resources to bear on the comfort and care and peace of the patient and the family. Absolutely. And then also after. So I think the biggest part of why patients often do not want to talk about it with their family members is because they don't want to worry them, right? We don't want to worry. We don't want to burden my children. We don't want to burden my husband or my wife. True. But at the same time, you know, when that person is no longer here, the family is usually the ones kind of left with that situation to kind of go with so that support in terms of like the chaplain, the social work and the bereavement is offered even after the person is no longer here. We've got about a one minute to break, Aaron. Sure. I'm sorry. I took a long time talking. No, no. What is one or two, what are one or two aspects of Bristol hospice that you think set that service apart from the others on the island? Oh, definitely. So I think then the first thing is that we offer a lot of palliative care. So I think that, you know, a lot of the time people think that hospice is only for end of life or the last few hours, but we can do palliative radiation. We can do IV hydration. A lot of things that maybe 10 years ago or even presently some other hospices wouldn't be interested in doing. Interesting. So I would say the palliative service is... Palliative means to cover. I don't know if you've ever, you know what pallbearers are. Yeah. They took care of the covering over the casket, which was the pall. Right. So palliative comes from that same word. Cover the pain, cover the anguish, and to ease life then through that. Is there one more thing about Bristol that you think is really wonderful? Oh, I would say that we have amazing staff like yourself and our clinical staff. Our medical directors are really, really involved. Our nurses are just super caring and we do probably the most nursing visit with our patients. Beautiful. We're going to come back and look at some resources that are available in this community. Erin has an amazing website. I want to introduce you two, and please stick with us. Aloha. I'm Jane Sawyer with the Small Business Administration and one of your hosts for Adventures in Small Business, a partnership with ThinkTech and with the Hawaii Small Business Development Center, the Mink Center for Business and Leadership, and the Veteran Business Outreach Center. All serving small businesses in Hawaii and telling you the story about their strategies, their ideas, their drive, and the way they help Hawaii succeed and be a bright light in small business. You'll find it here every Thursday at ThinkTech. Thanks for joining us, and we hope to see you soon. Aloha. This is Rob Hack. My show is exporting from Hawaii every other Thursday from 12 to 12.30 p.m. where I bring in people involved in the entire exporting infrastructure in Hawaii, including government, academia, and manufacturers and shippers themselves. Please join me every other Thursday, 12 to 12.30 p.m., and exporting from Hawaii. Mahalo. We're back here from Honolulu, and the program is Elderhood, Aging Gracefully, and I am convinced with the help of folks like my client or my companion here today, we can age gracefully into and through our Elderhood, which is a stage of life. Thanks for being a part of this, and thanks for ThinkTech Hawaii and all that they make available to us to share these explorations, to challenge our intellects, and to enable me to share with you some of the coaching basis of my own coaching for Elderhood, which I would do with you if that's something that you would like to get involved in. Aaron Hamilton is our director of community development at Bristol Hospice. Aaron, what about this website? You have an amazing website that you introduced me to, and Eric will pull it up here for us, and share a little bit first about how you decided to get into it, and how did you decide to develop it? Sure, so I think it was definitely being in the field, and definitely along the themes of the show is preparation, and when I would meet families, I would say the most common denominator that a lot of people shared was just not being prepared on so many aspects of it, and not really having the access to the resources that, even the professionals in the field, we struggle with, you know, getting all the new updates and everything like that. So that was kind of the catalyst for me to start a website, and I just wanted to make sure that everybody in the public had access to all of this information that we get a kind of experience in our day-to-day lives at work. Erin is a certified social worker, and has moved into this role, having also served as the ASON for Bristol Hospice, which means that she connects with people who are coming into the service. So if Eric will bring that up now, we'll start to use that as you think might be best. Sure, so I would say definitely in terms of, you know, your quick kind of go-to, you can look at the Community Resource Library and go ahead and click that, and you can just click on Resource Library, and it's going to give you a list of topics. So I think one of the first things on the list is going to be the Advanced Healthcare Directive and the PULS. If we click on that, that's going to bring you to kind of an area that will explain what the Advanced Healthcare Directive is, the Power of Attorney, or the Living Will, and then also if you scroll a little bit down, it's going to have four different options for you. So you can click on the Advanced Healthcare Directive, you can click on the PULS, which a PULS is the Physicians Orders for Life Sustaining Treatment, and that's probably going to be a bright green paper that a lot of you have probably seen, and you can really just look at the different topics there and see what are the choices and what that means to you. This can be completed at any time in your life and as many times as you want and can be changed, and then a doctor is needed. Just as an aside, because I'm here alone, my girls, my daughters are in Denver, Colorado, so I didn't have anybody. I thought, you know, if I have an accident, how is anybody going to know what to do? And so I filled out my PULS and I filled out my Advanced Directives with a piece called Five Wishes, and I've made that available to my physician, I've even given it to my business to my supervisor. So yeah, I really think any time of your life it's important to have that in place.  Absolutely. So we'll go back to the website. And then if you go back to the website and look under the Resources Library, you can go back to the Resource Library as well. I think a large portion of this as well is as we age, there's going to be different challenges in our lives and levels of care that you may need. So housing is usually one of the most complicated issues to really navigate, especially when we're in a hospital setting, maybe we're meeting the families there or we're meeting them at home and there's an anticipated decline in whatever disease state they're currently being challenged with. There's different options. So there's a care home, a foster home, a nursing facility, assisted living facilities. There are going to be patients that do not even have a home or housing available so that would be more like a transitional or emergency shelter situation. A lot of people do not know necessarily about the community care foster homes and that's a good way of kind of navigating this as well. That's more of a home setting. So if you click on that link right there, it's going to redirect you to the government site for all the certified licensed foster homes, their addresses, their phone numbers, their contact information as well. So you can find if it's for mom or dad, you can see who's the nearest one to you. And then when you go back to the resource library as well, let's say maybe the foster home situation is not for you and you want to go ahead and look at maybe the skilled nursing facilities and housing. There's also the assisted living and senior community. So we can click on the assisted living and senior communities tab and that's going to really just talk to us about what is the difference between an assisted living situation of retirement and a senior community. So the assisted living facilities are going to offer your meals, they're going to do your laundry, but what does that look like financially and really kind of just again going back to the idea of preparation and planning. So you can go through that whole tab and just really check out each one and maybe there's going to be a part of your life where doing assisted living is going to work or another when you'll maybe need a foster home or a nursing facility but at least having that accessibility to those resources are important. I want to be in my own home. Let's say I have six months to death to dying prognosis for whatever reason and I get in touch with Bristol Hospice and I say I want to stay at home as long as I can. So what are the financial arrangements? Let's say that I'm staying at home and how can I have help with there's no way that I can do it on my own but what about the financial arrangements available for the rest of that six months for me? Yeah, absolutely. So definitely I would say the most common thing is most people want to stay in their home, right? That's very, very normal. That's what we all usually want. Nine out of ten of us. So hospice services are paid for by Medicare when you're in the home setting. So when you're 65 and older it's going to be Medicare if you're 65 and under.  That would cover it as well. And then if you have, let's say you have an HMSA plan, some of them will actually pay for you to be in a nursing facility but again if that's not the route that you want to go, your Medicare or your normal insurance would pay for that to be in your home setting. That would include your entire staff, your interdisciplinary group. So that chaplain all the nurses and medical help as well as the equipment and medications as well to help sustain you in your home setting. When I worked in Denver, a hospice in Denver in the Denver area, it was set up as a long-term care facility. That's how it was established but specializing in hospice care. So we had patients who were there for several years on long-term care. And then we would recertify them every six months for the eligibility to, for hospice care within our facility. I understood that the facility went that direction in the first place so that Medicaid could be used for room and board. Is that accurate? Yeah, so if a person qualifies I think it's a big thing and actually if you go to the website too as well, there's a section for what is Medicare and what is Medicaid. So I think I often hear those terms kind of switched back and forth and really the difference is going to be if again we're 65 and older, Medicaid's going to be based on financial criteria. If a person meets financial criteria, they would be able to hospice benefit pays for them in the room and board situation in a long-term care setting like that. Yeah, okay. What else? So if we're going to go back to the main resource library on the website I would say that a big part of it is definitely like kind of what you're talking about is support groups and senior centers as well. So really just talking to everyone in your situation, in your circle and just finding others to connect with and see what has worked for them and what hasn't worked for them and really just getting that feedback as well. You can go and click on the different links and see in your town or your zip code which support groups or senior centers are available. So I think that's definitely resourceful as well. So there's a lot of resources out there so many. So even dependent upon your diagnosis. So let's say you know you have renal disease or Alzheimer's or mom and dad has Alzheimer's or dementia a lot of the time too the resources are there for the family members right because yes the patients going through it too but then the family members the spouse are going through it as well and often just need someone to touch with and kind of reflect about what they're going through. Sicily Saunders who originated hospice care was a social worker a physician a nurse and a self-proclaimed member of her church of England. And she identified four different pains in that. There was a social pain of relationship with others and financial issues sometimes there was a pain of the physical pain of course medical pain I mean medically addressed there was a pain of what was the third one and then the fourth one the spiritual pain but she built hospice care around those four pains and really around her own personality so we inherited that and our interdependent or interdisciplinary team is made up of those folks the social worker the medical director nurse and CNA the bereavement caregiving for community and then also spiritual care so all hospice attempts to do that Bristol hospice has its own special abilities I think. This goes this is going to go global I have friends in Sweden and other places in London we're going to watch this so it's applicable anywhere but you're specific I mean the general categories but you're specific offering of this this website is just a gem Erin thank you and I know you've done this out of your own selfless desire to help and thank you very much. And I just want to throw it out there that it's 100% free there's no signing up or anything like that anyone can access it and the more we know the better we can prepare and make decisions so thank you so much for having me. It is just a really pleasure Erin thank you. In my coaching I want to help you make your elderhood real and wonderful and I can do that through groups I can do it online with you individually make it real make it wonderful


Well, you can learn more about this industry. So I have prepared in advance a short summary of the conclusions we get to in a typical secure development course. Since we focused most of our resources here on mitigating issues in hacking methodologies rather than mitigation of exposures, I created something that will serve as an optimal page. Let's see. No, that's not it. There it is. In general, in order to mitigate applications, or mitigate exposures in applications, we have to include various security controls in our application. Now, those security controls can be placed under categories. But in general, instead of trying to mitigate past traversal and design injection and SSRF and RFI, trying to figure out what's the exact signature of each attack, that's a job for web application firewall, not for a developer trying to protect its application. Going for the blacklist approach and trying to figure out what's the exact method each attack will use is counterproductive to an extent. The best method is to use mechanisms that prevent the infection vector. I'm trying to use some sort of analogy here, but no. Think about it. You don't want to get infected from somebody who's sick, don't drink the water he's drinking, don't eat the food he's eating, don't get too close to him. Handle the infection vector. There's airborne viruses, the viruses that are delivered, no, true unknown. You got the point, okay? Instead of focusing on the attack, we're going to focus on the infection vector. So, past traversal, RFI, SSRF, these attacks are being delivered through input. So, we'll validate the input to mitigate them. Forced access attacks, those are attacks that, you know, they're abusing the lack of control or authorization enforcement. So, we'll enforce authorization.  So, we'll reduce concern of controls. We'll use mechanisms, generic mechanisms, that handle the infection vector that the various attack categories are using. So, instead of mitigating one type of injection attacks, we'll mitigate 80, okay? Instead of mitigating one type of access control attacks, we'll mitigate 70. The point is to mitigate the method, the infection method, the attack will be based on, okay? To make things simpler, I have prepared a seemingly perfect webpage. A webpage that's supposed to do all the validations one step at a time. I even prepared it in two different technologies, Java and Node.js, okay? Just to give you a glimpse. So, I'm going to go over the various control that you should see in your rest service, web service, webpage, and in each and every one of them, at least the authenticated ones, and if you're missing one of those controls, it probably means you either lack a certain functionality or are vulnerable to specific vulnerability, one of those we discussed, or another one, okay? One of the ones we didn't discuss. So, initially, a webpage should begin by verifying the authentication and authorization that is in access control of the accessing user. It doesn't matter how you do it. A flag in the session, verifying a cryptographic token, verifying a necessary token in a header, it doesn't matter. JWT tokens, as long as you initially, when the module starts immediately before everything else, verify user is authenticated, and that is authorized to access that specific module, okay? That's the first phase. It doesn't apply for public pages, you know, the login page or the help page, but it does apply for every internal component except whitelist models that are unauthenticated. As opposed to using a blacklist approach, which is, in my opinion, counterproductive, I would even split content which is public to a different server. I really recommend using the white box approach in authentication and authorization, okay? As much as possible. As in, you can't access any page without authentication except the login page, the password recovery page, and the help page, okay? That's the best way to define it. However, technology has its own method to define it. In Java, you can use various security constraint instructions in the WebXMR files. You can do the same for WebConfig and Azure, you can do it in any technology, and I won't get into the technology-specific path. That's more appropriate for the technology-specific secure development course. That's the basic, okay? That's the first phase. If you're afraid from automated attacks, okay? And from, we haven't covered that type of attacks in our course, third-party attacks, click-jacking CSRF attacks in which other website abuse users using them simultaneously while they're authenticated to your website, you need an anti-CSRF mechanism, anti-click-jacking mechanism, and anti-third-party mechanism as the second phase, okay? If I would have implemented a page or a module as long as it's a web module, web module, not test module, you probably need a validation that makes sure that there is an anti-CSRF token which is valid and that the domain access in you is a permitted domain, a domain that is allowed to fair users to you, okay? You can check the referral, handle yourself or use the X-ray options element for the browser or C-spreaders, there's various methods, but that's the second checks. If it's a REST service and you don't have it, you know, in most cases, you're okay. If it's a web page and you don't have it, you'll probably vulnerable to the click-jacking CSRF or various attacks you haven't covered in our course, okay? The third validation, and you know, people think of it as the first validation, it's actually the third, at least in my opinion, is input validation. And you would typically use the white list approach whenever possible in input validation. Instead of validating if there's a quote and double quote and dot and dot dot slash, we would go for validating whether or not the input has only permitted characters or artists. It won't work in every possible input like free text fields, that will be hard.  So it won't work for every field, but for the vast majority of fields, you can implement very efficient white list approach. Like, if this is a numeric field, only numeric values. If this is a string field, only lacking characters and numbers and spaces. And so on and so on and so on. Get to a list, it includes as less characters as possible, and it should mitigate on its own. Many of the injection attacks out there, okay? That's the third validation.  All has the fantastic ESAPI validator classes that are able to validate file, pass, and a bunch of other elements. NPM, you know, I'll just skip to the Node.js sample below. There's the NPM validator methods in Node.js. It does something very similar. It validates the values and email, pass, or no. Whatever you want. Just check what the available options are. You can really save up A, a lot of development time, and B, a lot of unnecessary mistakes and prevent your code from being attacked for simple injection attacks. The fourth mechanism I would verify is that we have secure data repository access. I'm intentionally avoiding the world database because there's various data repositories. Doppleting system is a data repository. An internal file share is a data repository. Mongo is a data repository. The protocol being used by the server, the frontend server, to access the internal data repository may change. It can be SQL, it can be LDAP, it can be operating system access, it can be JSON when you're accessing Mongo, okay? It doesn't matter. Use classes that embed syntax escaping as much as possible while accessing the data repository. In SQL, and that's an example, search for similar classes for other protocols, I would use parameterized queries, which are elements that prevent syntax. We didn't get to SQL in our course, it's a very short course, but we used quote war one equals one. It's an SQL injection type. We kind of effected query. I would prevent the effect both by input validation and by using classes that access the SQL which are not vulnerable to the injection, that ignore syntax character, trying to affect the pass of the file or trying to affect the pass of the SQL query. Node.js, for example, there's classes that actually prevent syntax character from affecting the pass of the file being accessed or the command being executed, okay? You can use those, just as an example. So, we covered authentication, authorization, we covered anti-automation, anti-CSRF, in general, anti-click checking, we covered input validation, we covered secure data repository access. The first place would be information disclosure prevention, okay? All of the data that you're presenting to the user that can assist an attacker, even though you're trying to help, okay?  Helping him enumerate the valid username and password instead of the combination, okay? Reducing consumer control. This one isn't the phase. Up until now, it was one, two, three, four, those were phases. Five, information disclosure prevention is kind of like a guideline for the entire page. Six is the same, reducing consumer control. I'm trying to be gentle here.  Reduce his control to the minimum necessary to function properly. That's it. Like the least privileged element we use in tele-linear organization, apply the same concept to the user and what he's able to send to the client, what you're accepting from the user. And avoid hidden parameters or secret parameters or all of those things. Minimum, the less the user will be able to affect the server-side calculations, the less problems we'll have, okay? So if there's a possibility to get certain amount of content from another source instead of users, prefer that, okay? So cryptography is just a guidance. We haven't gotten to cryptography at all here. We haven't even gotten to cryptography attacks, but these days we recommend in terms of protocols of communication with the client to use TLS 1.2 or above for assistant implementations. It's more configuration issue than development issue these days. We recommend using AES-256 for local data calculations. And if you're storing hashes, okay, of passwords or whatever, we typically recommend SHA-256 with salt, okay? I'm not getting into the details. Those of you who will need to implement it can take that line as a reference of what we should or shouldn't have. There's going to be debate, we don't know if we should have, use be-crypt or SHA-1 and even into the debaters. That's my recommendation, okay? Context-specific output encoding, unlike everything I said so far, is a phase in the process. So if you had a couple of phase, authentication, automation, validation, escaping, okay? Or more accurately, secure data repository access. Output encoding is a phase primarily for web modules, not for any module, not for WEST, more for web in which we neutralize the effect of malicious input embedded into the output. We haven't discussed those attacks in our course, but it's a typical phase. Anything the user that's, user is sending us, which we embed in the output and the response may affect us the wrong way. Or it includes content from another location or whatever that attack is. We typically tend to encode user-originating input before embedding it in our output. There's various methods to encode methods in Java. It's typically the encoder classes in ESAPI. They're a bit slow, but they work and they're also context-specific. You can encode using HTML encoding or JavaScript encoding, depending on what you need for the moment, okay? At the moment or at the specific scenario. Node.js has similar classes. I'll just search for them. Actually, I've used a Node.js API here in our example. There's other Node.js libraries that's just the same. You can use them as well. And that's pretty much it. That's the baseline.  The authentication authorization validation should handle most of the access control issues. It won't handle backup files. You have to make sure that they could upload it to the web server. It really includes the files necessary, but it will handle other forceful browsing incidents. At least most of them, okay?  Those are necessary in web applications these days. Very necessary, okay? So if you have a web application that hasn't seen them, you probably need them, okay? The input validation, actually, that's a known issue. It's kind of key. These days, you don't have to write it on your own. There's prepared classes to help you out with it. Why not use them? ES API and validator. You want something in .NET or you can find something. There's content for almost every development language to use for validation, so for custom or pre-packed validation, pre-configured validation. Secure data repository access. You have classes that enable secure access to Mongo, to databases and to file systems, depending on the technology. Those can prevent attacks, even if you failed the input validation. Even if you didn't do a valid input validation, just by using a secure class to access data repositories, you can prevent that attack. It's another layer. It's a more effective one, okay? So I highly, highly, highly recommend it. All the rest, kind of basic, okay? Other than that, questions? Questions about mitigations? Yes. What is ES API? ES API, Enterprise Security API is a project by OS for various development core technologies. I think it's really mature in Java. I don't know about the status in other technologies, but it's really mature for Java. Pretty much whatever you want there. Any almost any security mechanism that you can think of, you probably have some classes, funcars, libraries that can assist you. And Node has, there's projects of OS for Node.js, but it's not comprehensive enough. It doesn't have enough fits. There are other projects in the NPN library that doesn't have that. I give examples as the validator class.  NTCSRF libraries and some of the others. Other questions? Yes. Any other questions with a slightly available? Of course. I will charge you all for every download. I'm getting it. I have to feed my children somehow, but don't worry. Then the giveaways, which are like summaries of the entire course in like one pages like that, that's the purpose. Like a one page summary of the course for both payloads of attack and for mitigation techniques will be available in addition to the course presentation. Okay? Other questions? Because I want to give you like the finale of where to learn from. Yes. Encrypted cookies? Oh no. You can use encrypted cookies which there's the whole model to use like a digitally signed cookies, like in JWT tokens or stuff like that. That makes sense. Encrypting cookies for what? Because attackers will be able to decipher their own cookies. If an attacker stole a cookie from somebody, it'll be able to replay it. It doesn't need to decipher it. So it won't help you in terms of whether or not the cookies were stolen. The only reasoning in encrypting a cookie or signing or something like that is they want to use a certain portable class model. If you want to reduce the amount of validations in the server side, you want to provide a cookie that contains a tonization of information and you're afraid the user will manipulate it.  It's a dangerous pass to take unless you're using prepared classes. Okay? Now JWT pretty good these days. If you're using other platforms, investigate a little bit. Okay? There was somebody down? Yes? Oh, I don't know. Three months, four months, couple of days. It will be available in the OSP website that describes this conference. Like the same website that includes the agenda. I mean, the presentation will be available in the website, this agenda, right? No, just get the order. And on the OSP cookie. Whatever you said. And you will all get a notification in your email about it. And if you only get one...  And then there will be a spam from OSP. You know, they'll just delete it. So don't worry, it will be available in the website. You can remember three months from now or three years from now. Unless OSP decide to go commercial, you'll be able to download it. Okay? And other questions? Yes? I noticed that most of this is server-signed. Yes. Yes, once upon a time, I would have said no. I mean, you would have asked me six years ago. I would say no, client-side security is simply irrelevant. In most cases, relying on client-side security is sheer stupidity. But these days, some client-side controls, especially because of the client... Well, the client dependency of... The tendency to cause clients to pass more and more information, like in platforms such as Angular, React, mobile applications, read mobile applications, the clients are doing much more these days. So they're becoming more server-like. So, for example, these days, mobile applications pass SMS. So, if you send an SMS with malicious input from one user to another, they will be able to affect his application. So these days, you probably need to embed some validations in client-side applications, specifically rich client applications. It's not necessarily as important as the server-side. It doesn't affect the whole lot of users. It may affect the specific user, but it has importance. So, as an answer to this question, I have a great slide that I've prepared in advance. I just predicted your questions. I didn't know what it has to mean. So, if those are the server-side controls, that's like a sample of client-side control. Those are the elements I would need to embed in a client-side application. You get that. Not sure of charge of profit, not profit. So anyway, enough with the jokes. Seriously guys, any other questions about the content? Okay. Some very good, relatively free resources to learn more about application security, hacking, secure development. I'm going to show you a couple of fantastic projects by all of us. I don't know why, you know, people don't use them as much as they should. A, if you want to learn more hacking methodologies, there's, of course, the OSP testing guide. Okay, I really, really, really recommend that you start reading at least the various attacks that's found out there, okay? It's a nice website.  I typically use that, I won't say on a regular basis, but every time I forget a payload, I refer it here, okay? OSP testing guide. Just Google it. Be, tick, tuners, okay? Be, if you want videos of various attacks, I want to learn a specific attack. There's a website called TechAPI. I admit I'm the owner, but I don't earn any money on it. It's free of charge. You can actually access attacks and see and learn about the attacks using videos or references to various other websites, such as OSP testing guidelines, okay? It enumerates, you know, it kind of like connects OSP testing guides with other resources, such as CWE and the CAPEC and other resources that attempt to explain or enumerate attacks, and also refers to various videos online that explain the attack, okay? Either videos from conferences or just, you know, videos from volunteers that are uploaded into YouTube. It currently lists about, covers about 288 different attacks, so try not to consume it in one day, okay? But anytime you want to learn about a specific attack, you can go there and it will also refer you to the rest of the resources or testing guide or attacks and differences, CAPEC, CWE and so on and so on. And finally, finally, a good set of videos to get started and just refresh yourself, you know? To figure out some basic concepts if you forgot about them is OSP ActSec Tutorials.  There's, it's a set of a couple of short videos. You can get, you know, reminder of the basics, proxies, SQL injections, CSRF, even attacks you haven't covered. You'll get a very simple and graphical explanation in the form of short video, okay? OSP ActSec Tutorials, a nice place to get started with. Those of you who want to get formal educations, you can get them in colleges these days, degrees these days, I don't know why, but I heard about it. Overline, YouTube, Udemy, you know, hands-on exercise, phones, news groups, okay? That's pretty much it. Anything else? Questions, requests? Can I have the card number? No? Okay, I hope you enjoyed. I did enjoy very much.