Hello and welcome. My name is Shannon Kemp and I'm the Chief Digital Manager of Data Diversity. I would like to thank you for joining the current installment of the Monthly Data Diversity Webinar Series, Real-World Data Governance, with Bob Sinner. Today Bob will discuss three ways to manage your data steward sponsored by InfoJax. Just a couple of points to get us started. Due to the large number of people that attend these sessions, you will be muted during the webinar. If you'd like to chat with us or with each other, we certainly encourage you to do so. Just click the chat icon in the bottom middle of your screen for that feature. For questions, we will be collecting them by the Q&A in the bottom right-hand corner. Or if you'd like to tweet, we encourage you to share highlights or questions via Twitter using hashtag RWDG, Real-World Data Governance. And as always, we will send a follow-up email within two business days containing links to the slides, the recording of the session, and additional information requested throughout the webinar. Now, let me turn it over to Nam for a word from our sponsor. Nam, hello, and welcome. Hi, Shannon. Thank you so much. Hello, everyone. It is InfoJax's pleasure to sponsor this webinar. My name is Nam Tran. I head up the Data Governance Practice at InfoJax, where we provide end-to-end governance services to the market, which means that my team supports our customers at any stage in their data governance journey, which can range from building a business case for data governance, creating a framework or implementing InfoJax Data 360, our governance platform. And through those types of engagements that we have with our customers, the one thing that I've seen consistently in many data governance programs is the need for data stewards. Now, Bob is going to discuss different ways to manage data stewards today, but first I want to take a few minutes to set the stage and briefly talk about why data stewards are important to a data governance program and therefore need to be effectively managed. Now, if you have any questions, please send them over to the Q&A session and I'll be happy to address them after. Data stewards are responsible for managing the data domain, which they are owned in their respective business units. What makes them critical to a data governance program is the multiple roles that they hold, starting with being a data domain expert. This includes resolving data quality issues, providing data access to the appropriate people, defining which is the correct data to use, depending what the purpose of that usage is, or providing business requirements for certain key projects within the company and so on. They are effectively the go-to person for a particular data set within the organization. This already makes them very important to the organization and a perfect candidate to be the governance representative for their business unit. And as a representative, they will need to participate in the data governance program to help set up the chosen tool to create and manage business data, such as definitions, business rules, and quality controls. They also provide inputs into policies and participate in the definition of processes and procedures within their business units to comply with those policies. Essentially, they help define how data governance works in their business unit. And last but not least, the biggest reason they are so important to the program is because they are the adoption champion for the program. Now data stewards work closely with the user community to solve data issues and inquiries on a daily basis. So they have a very strong relationship to those users. Therefore, they are your best advocate for data governance because they have the credibility, the constant contact with the user community to keep promoting the benefits of data governance and encourage those users to follow any new processes and guidelines created from the program. And that concludes my brief talk on why data stewards are so important to data governance. Now, without further ado, I'm going to hand it back to Shannon to kick off on the main topic of this webinar. Non, thank you so much and thanks to InfoJX for sponsoring this and helping us to produce all of these great webinars for everybody. And let me introduce our speaker for today, Bob Siner. Bob is the president and principal of KIK Consulting and Educational Services and the publisher of the data administration newsletter, tdan.com. Bob has been a recipient of the Dama Professional Award for significant and demonstrable contributions to the data management industry. Bob specializes in non-invasive data governance, data stewardship and metadata management solutions. And with that, I will give the floor to Bob to get today's webinar started. Hello and welcome. Hi, Shannon. Hi, Nam. It was great to have InfoJX as a sponsor for today's webinar. And I agree wholeheartedly with everything that Nam said about the importance of data stewardship and data stewards to your data governance program. This is one of my favorite subjects. If you've attended webinars before, you know that I love to talk about the data stewards. Actually, I talk about the data stewards as really being the engine that runs the data governance program. But today I want to talk to you about three different approaches to managing your data stewards. And I think you'll find that they're quite unique and they're quite different from each other. And it should be interesting to hear some feedback from all of you as to whether or not these things make sense and that they're at the appropriate ways to be able to manage your webinar or manage your stewards throughout your organization. So before I get started, I wanted to share a couple of things that are going on with me and with data diversity and with data governance in general. First of all, as you know, I do the real-world data governance webinar series. We've been doing it for several years, always on the third Thursday of the month. And next month is, that's actually the earliest in the month that it can be, the third Thursday of November 15th. We'll be talking about data governance in three levels of metadata. And those three levels of metadata are not the same as the three different approaches to managing your stewards. But I talk about three levels of metadata quite often and it's great to be able to have a webinar on that. So if you're interested, please register. Also, as Shannon had mentioned, I specialize in non-invasive data governance. And there's a book on non-invasive data governance that is available from Amazon or techniques or wherever you have an interest in purchasing books. Also, I'll be speaking at some upcoming data-versity events. In several weeks, actually the first week in December, I'll be speaking in Delray Beach at the Data Governance Winter event. And then I am lucky enough to be speaking at the Enterprise Data World event as well. And that's in Boston in March. There's an online learning plan for those people that like to learn more about non-invasive data governance. And you can find that through the Data-Versity Training Center. I am the publisher of TTAN.com, the Data Administration newsletter. If you're not familiar with it, please go out and take a look. Lots of new articles from a lot of different people. I don't write all the articles. Lots of different perspective on different aspects of managing and governing your data.  And that is the home of non-invasive data governance. So for more information on those things, please go and visit those resources. Today, I'm going to talk about this handful of subjects related to three ways to manage your data stewards. The first thing I'm going to do is I'm going to go into some detail as to the three different ways that I consider different possibilities of ways that you can manage stewards within your organization. Then I'm going to talk about some of the things you might want to consider when you're selecting the appropriate way to manage your data stewards. We'll talk about the benefits and challenges associated with each of those methods. We'll talk about how do we get our organization prepared for the approach that we're taking to implementing a stewardship approach to governing data within the organization. Like I said before, NAM really laid it out well that the data stewards are instrumental. Oftentimes, they represent different parts of the organization and how they manage the data associated with those different business functions. And then last, I'm going to talk about when we're looking at these different approaches and these different ways to manage your data stewards, is it important for you to stay true to the single method or maybe it makes sense to create a hybrid approach and select some things from the different approaches and make it fit perfectly to what will be accepted within your organization. I like to get started by sharing several definitions and so I'm going to share a couple with you today. If you look at my definition of data governance as the execution and enforcement of authority over the management of data, that's worded quite strongly. In fact, a lot of the organizations that I work with say it's worded too strongly and they try to temper it down and calm it down so it doesn't really put people on the defensive. And to be honest with you, execution and enforcement of authority sounds more invasive than non-invasive. That's really just the definition of governance. It's not the approach to how you're implementing governance. And the truth is that your definition of data governance and all of the definitions of terms that are really unfamiliar to your organization, it's really important to word those wisely in a way that's going to solicit some type of feedback from the people that are hearing the definition. So at the end of the day, the truth is if you're implementing governance to improve quality, to protect data, to improve understanding of data, it's important that you have the ability to execute and enforce authority. So that's my definition. I'm sticking to it. I think it works well for a lot of organizations. So my definition of data stewardship is particularly focused for today's session. And actually what I think is that stewardship is really the formalization of accountability over the management of data. And people in the organization have relationships to data already. And so to some extent they may already be stewarding the data. And so if we can formalize that type of accountability, and I'll talk about that throughout the webinar today, to formalize what people do with the data that they define, produce, and use, that's a really appropriate place, an appropriate way for a lot of organizations to implement data stewardship rather than assigning people to be stewards. Let's recognize the people for what relationships they have to data, and let's help to formalize what that accountability is associated with that relationship. I mentioned non-invasive data governance. This is the definition that I use for non-invasive data governance. It's really the practice of how we're applying governance in the organization. So it's really separate from the definition of what data governance is. We're talking about applying formal accountability and behavior, and using non-invasive roles and responsibilities. And I've talked a lot about those in past webinars. We're not going to go into the details of what stewards do in this session, but I know it's an interesting subject to a lot of people. But you're going to use the non-invasive roles, and you're going to apply governance to existing processes. And you're going to assure that, as I mentioned before, the definition, the production, and the usage of data is being done appropriately, and it assures that you're being compliant, that you're protecting your data, that you're improving the quality, the understanding, and all of those good things. So really non-invasive describes how governance is applied, and it's not really the definition which I use as execution and enforcement of authority over the management of data. If we're going to stay non-invasive with our approach to governance, the goal is to be transparent, supportive, and collaborative. And so the last definitions, or the last things I want to talk to you about in this piece of the webinar today, is what exactly is a data steward? We all seem to agree that data stewards are a critical component to a successful data governance program. What exactly is a data steward? And if you've heard me talk on the subject before, you know that I say that potentially everybody or anybody in your organization can be a steward of the data, depending on the relationship and what they do with data as part of their everyday job. So I say that a data steward can be anybody in the organization, and that could be somebody who's a business person, it could be a technical person if they define, produce, and or use data as part of their job. And that's a really important thing, because much everybody in the organization does at least one of those things, if not multiple of those things. And actually, these individuals become data stewards really only if they're being held formally accountable for what they do with the data. So the next thing I wanted to do is kind of break down that statement into three components. So I said before, a data steward can be anybody in the organization. You know, if they define, produce, or use data as part of their job, and if they're going to be held formally accountable for what they do with the data. So the easiest way to describe that is people that use data need to be held accountable for how they use the data. They need to protect the data appropriately. They need to share the data appropriately, define it appropriately. And so that's really the distinction between anybody in the organization that defines, produces, and uses data and a data steward. Because a data steward is somebody who does those things, but they're held formally accountable for what they do with the data. So just a different way to look at that. So who is a data steward within your organization? A data steward is basically a person that defines, produces, or uses data as part of their job, as I said before, and that they have a defined level of accountability to make sure that they're assuring quality in the definition of production and use of data. And again, break that term, that expression into three pieces. You know, it's basically anybody in the organization that does any of these activities with data, they have that defined level of accountability for the relationships that they have with the data. So potentially, and you may have heard me say this before, I say that everyone is a data steward. Get over it. In fact, I think that we need to look to cover the entire organization. So that means that we're not going to select a handful of people to be data stewards. What we're going to do is we're going to focus on first inventorying and knowing who defines, who produces, and who uses data across the organization. And if we can define what the accountability is that goes along with that relationship and we can apply that accountability to those people, then those people become data stewards. So when I say everyone's a data steward, get over it, I think that that's really, really important to this thing to keep in mind because it really changes the way that the program will be set up within your organization. So let's jump into the three ways to manage your data stewards. And typically, when I talk about data governance in general and data stewardship in particular, I look at there being three distinct approaches that organizations can use to determine who the stewards are within the organization. And I've talked about the different approaches before. There's that kind of command and control iron fist. You will do this approach to data governance. And there's a specific verb that is used when we're identifying or when we're recognizing that we're associating people in the organization to being data stewards. And the verb that I use is, I'll get my computer to work here, is that people are assigned to be data stewards.  You will do this approach. So no matter what you're presently doing, if you're assigned to be a data steward, the first thing that I've recognized in organizations is that people tend to push back. I have a day job. I'm busy 150% of the time. I don't know if I have any time to be a data steward. So assigning me to be a data steward may not be the best thing to do. So think about that. If you're in a business role and that you're assigned to be a data steward but you're already too busy, how are you going to take on the role of being a data steward? In the more traditional approach, people are identified as data stewards. And I'll talk a little bit more in detail about each of these different approaches, but the difference is that we're identifying people. So we're not assigning them. We're identifying people in the organization that are going to participate in the role of the governance program as a data steward. And in the non-invasive approach, which is the approach that I talk about a lot, is the mode that I use is that we recognize people as data stewards because being recognized for something, even if it's as simple as being recognized for a relationship that you have to the data, is oftentimes a positive thing. So if you can start out with people and you can tell them, you know what, you already used data. All we're really trying to do is help you to understand how it can be used, how it can't be used, how it can be shared, and those types of things. It's not really necessarily adding anything to their jobs, at least initially and right out of the gate. It depends on what types of activities you involve your stewards in. But I like to use the term recognize people as data stewards because of the positive connotation that comes along with that. So let's talk about each of these different approaches in relationship to the data stewards. And so the first bullet under the command and control approach is that we assign people to be data stewards in a command and control approach. And oftentimes in the organizations that take that approach to associating people as stewards of data, these individuals are assigned as being data owners. And you've got a handful or maybe more data owners. This is like your process owners and system owners. You've got people that you recognize as data owners. Well, I've talked about this before. I don't really like the term owner, although I know a lot of organizations use the term owner. The appropriate term to be using these days is a steward of the data. When you call somebody an owner, it implies that they are, it's their data, that they have responsibility, complete control over it, and that just might not be the case. In the dictionary, the definition of a steward is somebody that takes care of something for somebody else. And so in this situation, it's somebody who takes care of the data for the organization. And when you assign people to be data stewards, typically you're just selecting a specific number of people. It's a very finite number of people. Bob over there, he's the customer data steward. And Rick, he's the vendor data steward. And Mary, she's the product data steward. And so you only have a handful of people or more that you select to be data stewards in the command and control approach. And oftentimes the way it's communicated to people is that you will do this. You know, we're going to assign you into this role and you will do this. It really doesn't matter how much other work you have, you're now the data steward. You've been assigned. You'll do this. And this is truly the most invasive approach to stewardship, is where you assign people into roles rather than identifying or recognizing them. So what are some of the questions that people have about the command and control approach? And these are things that you may want to consider when you're selecting the appropriate approach for your organization. You may ask, you know, how will people in the organization accept being assigned as data stewards? And from my experience, what I've seen is that a lot of people, when they're assigned to be data stewards, they push back. They start asking those questions I mentioned before. Where am I going to find the time? What does this mean to where I presently do? How does it rank among my priorities? And it really helps that you're very clear if you're going to use the term data owner to define what you mean by data owner. So they're going to ask the question of, well, how do you define the role of owner? What responsibility? What accountability do I have for the data? And if we take this approach where we are assigning people to be data stewards, the question really becomes this, are we going to cover the entire organization with just a select number of people? And how are people going to really respond to when you tell them that you will do this? Oftentimes people consider the command and control and the assignment of stewards to being something that's over and above what their existing responsibilities are. And you know what? There's a different way. There's other alternative approaches to associating people with stewardship responsibilities within your organization. So look at the second approach I talked about. In the traditional approach, we're identifying people as stewards and you know what? We still need, it seems like organizations are starting out with these people as being the data owners. Again, so we need to be very clear as to what we're defining as the responsibilities of a data owner. And it's still just a select number of people that are identified to be data stewards and they're told, you know what? You really need to do this. It's less invasive than the command and control approach, but it's still somewhat invasive because people feel as though this is an add-on to what their present responsibilities are. So again, traditional approach is okay, we'll go into a little bit more detail on that in a couple minutes here, but I also wanted to share with you what are some of the questions that people have about the traditional approach. And they're very similar to the questions that people may have about the command and control approach. How are people going to accept being identified as stewards? How are you going to define what it means to be a data owner and really give people clear understanding that the organization owns the data and that they don't really own the data? The question I get a lot is, well, then why are you calling me a data owner if it's not really my decision? You know, basically, the data is owned by the organization. And again, when we cover the entire organization by just identifying people as data stewards and we tell people that you need to do it, but it still feels for a lot of people as though this is going to be over and above what they're presently doing if they've now been identified as data stewards. So let me explain to you what I mean by the non-invasive approach because the non-invasive approach is really quite different than assigning somebody to be a data steward or identifying somebody as a data steward. The verb that I mentioned before that I use is that they recognize people as data stewards. So the people that are data stewards in the organization potentially are recognized by their relationship to the data. And I mentioned before, if you define data, you need to have some responsibility around defining the data, making sure that the metadata that we're collecting, the business glossary terms, the data dictionary, all the information about the data is recorded in such a way that's going to be beneficial to people. And I talk about the fact that that typically everybody in the organization is potentially a data steward and it really covers the entire organization just covering those individuals that you've assigned or that you've identified as being data stewards. One of the data differences in associating stewards in this manner and this approach is that instead of telling them that you will do this or you should do this, the approach is that you're already doing this. You already have this relationship to the data. We need to know what that relationship is and we need to help you to define, produce, and use the data better across the organization. We're not really asking you to change much of your job. I mean, certainly there will be points where things feel a little bit more invasive than you'd like them to, but if we're telling people you're already defining producing and using data or using data, and we're going to help you to understand the implications of how you define, produce, and use data. So this is really what I consider to be the least invasive approach to stewardship and that's why I call it non-invasive, non-invasive governance and non-invasive stewardship. And again, what are some of the questions that people have about the non-invasive approach? How are people going to accept that they're now being recognized as data stewards since you're not really handing them a lot, at least right off the bat, handing them a lot of additional responsibility, then they might not push back as hard as they would push if you're giving them or they're feeling like you're giving them more work to do. I know that Nam mentioned earlier in the session today she talked about the domain responsibility. So oftentimes there's different levels of stewards within the organization. I'm mostly talking about the operational stewards, those people within the business units that define, produce, and use data as part of their job. There's another role that she mentioned, which was the domain steward. It's the subject matter expert within the organization. And right now you might think about, well, if you have a question about loan data or you have a question about product data, who do you go to? Is that person, the subject matter expert, can they provide you information to help you to do your job? So there's differing levels of stewards. There's operational stewards that define, produce, and use data as part of their job, but then there's also the domain steward. And these people potentially are already subject matter experts. I actually had a client ask me a question not too long ago, these people that are domain stewards, that are subject matter experts, that really have responsibility around the subject matter of data, do we need to call them domain stewards? And the truth is no, you don't need to call them domain stewards. Actually the person asked me, can we call them enterprise data subject matter experts? Because that's really what they are.  So you've got to make sure that you're defining the role of the operational stewards, the people day to day and what they do with the data and where they're held formally accountable. And then the domain stewards, those subject matter experts are really a critical component of most successful data governance programs. And so then the question will we cover the entire organization by following this approach? And this is really important. The answer to that question is yes. It might make your program a little bit more detailed, a little bit more complex. You might need to communicate with more people, or obviously you'll need to communicate with more people, but the fact is that if you can inventory who has responsibility for defining, producing and using data, you can cover the entire organization. So if you keep that in mind and that's what a lot of organizations are striving for, is governance throughout. You're not going to take a handful of people and say, okay, you folks over there, you're going to have responsibility for protecting data, but those folks over there that use the same data, they're not going to protect the data? No, the fact is that you can really look at the relationships people have to data and formalize the accountability that goes along with that relationship and you can do it in such a way that you're telling them, you know what, you're already doing this. We're just going to help you to do it more efficiently, more effectively, more formally. We're going to do it better for the organization. So then really the last question about that approach is, is this an approach suited to fit the culture of your organization? Do you already have people that have responsibility for data that if you just formalized it a bit, that it would cover everybody in your organization? So those are the three different ways primarily. There's the command and control, there's the traditional approach, and then there's the non-invasive approach. So let's talk about what you should do to select the appropriate way to manage stewards within your organization. And I'm going to walk through each of the different approaches and talk about them here real quick, real briefly. So one of the things that we need to consider if we're going to take a command and control approach is the level of the mandate within the organization that's going to be required in order for this approach to data stewardship to be effective within your organization. Who is it in your organization that has to say that we're going to assign people to be data stewards and they're going to need to do whatever data stewards do as well as what they're presently doing. So we've got to look at to see, well who's going to be the one that's going to make this the mandate? Is that we're going to assign people to be stewards and they're going to have to accept that. And oftentimes with the command and control approach, people say data governance is not optional. We're going to need to rule with an iron fist. We're going to need to get people to behave in a desired manner. Even if it's just a handful of people that we have assigned to be data stewards, we do recognize that there's other people in the organization that have accountability for data. We want to make sure that they also behave in a desired manner. And we also need to think about who is the authority or does your data governance team or data governance office or administrator really have the authority to be an implementer of this type of approach to data stewardship? Oftentimes what I find is that the data governance office or administrator or whoever that is that has responsibility for your program doesn't necessarily have the authority to assign anybody anything. And so you've got to think about that when you're determining what's the appropriate approach for you to manage stewards within your organization. All right, let's see here. Here we go. The traditional approach. We've got to think about the same things associated with the traditional approach to stewardship as well. If we're going to tell people that they're data stewards, we're going to identify them as data stewards and help them to understand that they have some additional responsibility, well, what level of mandate is there in the organization that will require people to participate as data stewards to be being identified as being data stewards? You know, we can also, in a lot of organizations that take this approach, they say data governance is something that we all should do. And the key word in that phrase is we should do this. But not necessarily, there's not necessarily a mandate that people have to get involved. And I'll talk a little bit more about it. I compare it to a movie here in a second, but the traditional approach to stewardship is still the same. You want to get people to behave in a desired manner, and if we're going to identify people as data stewards and help them to understand their role, if it's not everybody in the organization, is that going to get us where we want it to get us? Are we going to be able to get people to behave in a desired manner if we just identify them as stewards? And again, also, the data governance team or the office or whatever you call it, do they have the authority to be an implementer of this type of approach to data stewardship? In the non-invasive approach, is there a level of mandate that's even required? If the first thing that we're going to do is inventory who defines, produces and uses data across the organization, it doesn't necessarily have to be a mandate because we're not really asking people to do anything yet. At some point, we're going to be more detailed with what does it mean to use specific types of data? How can you handle data that is classified as being confidential or being private or being public? What level of mandate is there to apply this type of approach to data stewardship? In this approach, data governance is something that's pretty much a matter of fact. You're already doing it, people behave. We can still work to get people to behave in the desired manner, but we have to recognize that there's going to be more people in the organization that we're going to need to involve because there's lots of people that are using data that is classified as being sensitive. So we don't want just some of them to manage the data appropriately. We want everybody who touches the data that is classified a certain way to handle the data appropriately. So the chief idea here is that we want people to behave in the desired manner. And oftentimes, you don't need to have a whole lot of authority to implement this approach to data stewardship.  And of course, there's going to be some communications and stuff that you need to share with them. But if we look at the fact that everybody is a data steward, it is certainly going to change the way that we need to implement our data governance program. So think about this. When you take the approach, if you decide to take the command and control approach or traditional or non-invasive approach, consider what the impact that's going to have on your organization. So how is it going to impact how you develop your program? And you define roles and responsibilities. Instead of having specific responsibilities for operational data stewards, maybe we can just say that if you use a certain type of data, you're going to be held accountable for how you use that data. How is this going to impact the way that we sell governance across the organization? I've been known to ask people at the beginning of sessions that I've given, how many of your organizations govern your data? And typically I only see some of the hands go up. And then I ask the question again, how many of your organizations are governing your data? And I tell everybody to raise their hands and they look at me kind of odd and I say, well, the fact is that there is governance taking place, informal, inefficient, ineffective. And if we're going to make this cover the entire organization, this is what we need to do with these people based on their relationship to the data. So it really impacts the approach you have and how you sell governance and stewardship to your organization. How do we communicate with people? Well, instead of saying you will do this or you should do this, we communicate by saying you're already doing this. We're going to help you to do it better. You know, we also look at how the approach will affect your ability to influence people to participate as students or how you're going to be able to enforce the rules that are now associated with different relationships to the data. So I think it's a very important consideration to think about what's the impact on the approach that we're taking to associate people as data stewards and what's the impact that that approach is going to have on our ability to develop, sell, communicate, influence and enforce the stewardship aspect of the data governance program that we talked about earlier is, we know is critical to success of a program we need to have data stewards. So the benefits of a command and control approach, well, it depends on your organization. Some organizations need that to be very authoritative. You know, I use in my definition execution and enforcement of authority over the management of data. And the command and control approach is much more authoritative. It's people will have to follow the approach, it's really strictly a top-down approach and it's all about the control of the data. So that can be a good thing for your organization if that's the type of approach that needs to be taken or it might not be as much of a benefit. It might be more of a challenge and we'll talk about that in a second as well. The traditional approach to data stewardship, I mentioned that I kind of compare it to a movie. I compare it to the field of dreams and if you're familiar with the movie Field of Dreams, one of the key lines out of that movie was if you build it, they will come. And so in a traditional approach, you might have an excellently defined program and you may have sold it to management appropriately and the idea is that you even set up a council and you've had clearly defined roles and responsibilities for people but the fact is that in this traditional approach, oftentimes people are going to respond based on the value that they see or the value that they receive from being a data steward. In the non-invasive approach, again, there's less reason for stewards to push back because you're not necessarily handing them anything that they don't already have, at least initially when these people are recognized as data stewards. It's really hard for leadership to reject the non-invasive approach to stewardship because, again, you're not going to say that we're going to only have these groups of people over here protect the data. We're not going to have everybody that touches that data protect the data. They're going to say, no, no, no, we need everybody in the organization to make certain that private data is kept private. That confidential data is kept confidential. So it's really hard for leadership to reject this approach, especially if you can be successful in making certain that everybody with a certain relationship to the data is now being held formally accountable for that relationship to the data. And what that means is, as I've said before, definers are responsible for looking to see if that data is already defined. Producers understand the impact of the data that they're producing. Again, it's very difficult for leadership to reject this idea as being something that doesn't make sense to the organization. No, we're only going to have... We're only going to assign or identify a handful of people as stewards. No, the fact is, we really need to look at the relationships people have to data and formalize our program associated with whatever that relationship is, definers, producers, and users. And the fact is, one of the benefits of the noninvasive approach is they cover the complete organization rather than just a handful of people in your organization. And if you're going to cover everybody in the organization, it's going to make sense to bring in a tool like InfoJix or somebody like that to help with some tool like that to help us to record who's doing what with the data. So it can make it easier for us to be able to communicate with these folks and let them know what it means to have that relationship to the data and how they can govern the data and stewards the data better for the organization. So really, we're changing people's view in general of what data governance is. People here that serve data governance, they want to go running for the hills. They think it's going to be difficult. They think it's going to be over and above when the fact is we can start out our program in a more noninvasive way where we're recognizing people based on their relationships and we're helping them to do a better job of managing the data across the organization. So taking a noninvasive approach, one of the benefits is it changes people's views on what they think about data governance in the different ways that data governance can be applied. So let's talk about some of the challenges. What can prevent command and control approach from being successful? Well, I talk about best practices a lot and one of the very first best practices, if not the first best practice is the leadership in your organization, however that's defined, but they not only support and sponsor the activities of governance and stewardship, but they understand the approach that you're taking to implementing these things in the organization. People will push back when they're told what to do if they're assigned additional work. People need to make time to be stewards. They're evaluating how well they... People don't like it when they're assigned things that they didn't have some level of agreement of being assigned. So there is a lot of pushback. That's one of the biggest challenges of the command and control approach is that your senior leadership might not really understand what the heck it is that you're trying to do and say, you know what, where am I going to find time to do this? I don't have time for this. The fact is they're already doing it and if we take that approach that's a definite benefit or a challenge or a sub-benefit to the non-invasive approach. What can prevent the traditional approach from being successful? Well, oftentimes leadership supports and sponsors, but they don't truly understand that just by having a program there doesn't mean that our data is going to improve. It's going to improve in protection. They don't necessarily understand that we really need to cover the entire organization. One of the challenges also is that people will follow the approach if they see that there's some value in it for them. That's a guarantee that if there's nothing that they're getting out of it, when are they going to find time to be data stewards? They're only going to really participate if they see that there's some advantage to their doing so. And that's the only time that their management is going to find time is that they see that there's going to be some benefit in their area. So one of the challenges, again, of the traditional approach is that only specific people are going to be evaluated on how well they steward data. And as I mentioned before, everybody is a data steward and we should really get over that fact. We really need to make sure that we have complete coverage for our organization. What can prevent the non-invasive approach? Well, I've heard a lot of different things. I've heard people say that if everybody is a data steward, then nobody is a data steward. And the fact is I just can't understand that logic. The fact is that we need to make people or get people to be held formally accountable for what they do with the data. That's what governance is all about. It's what stewardship is going to solve for our organization. And in fact, instead of it really being a do-nothing approach, it's more like a do-everything or a do-everybody approach. You know, one of the challenges of doing it is you've got to be very incremental in the way that you roll it out to your organization. You can't take the big bang approach and turn data governance on for the entire organization if you're planning on the fact that everybody in the organization potentially would be a steward of the data. It adds complexity to addressing everybody in the organization, as I mentioned before. And one of the challenges might be that leadership doesn't understand that there is this type of approach to implementing a governance program. But they might want to know, well, how are we going to cover everybody in the organization when a lot of the traditional program or the command and control type programs only call out for a handful or dozen or dozens of stewards rather than everybody in the organization. So those are some of the benefits and challenges of each of the different approaches. In the time I have remaining here, I'd like to talk about how do we prepare our organization or do we prepare for how the organization will respond to these different approaches. And again, I'm going to walk through command and control, traditional, non-invasive, but I also wanted to introduce the idea of the hybrid approach. And I'm going to share with you right now or on the next slide several of the core components to a successful data governance, information governance, information as an asset, whatever you call your program. You don't need to stay command and control in all aspects, in all components or traditional or non-invasive. You can pick the best approach for your organization of each of these different approaches depending on how that will best fit for your organizational culture. And I want to share this diagram which you may have seen before if you've attended my webinars. This is one that I traditionally use to compare if you look across the columns there's command and control, traditional, non-invasive, and the five core components of a successful governance program are roles and responsibilities and the authority that goes with those roles, governing processes, making certain that we do effective communications, that we have metrics, and we can measure the success of our program and that we're going to use tools, we're going to use things that can help us in our organization to implement governance and to really keep and manage what it is that these data steward folks do across the organizations. That's where the tools become really valuable. So what I wanted to do is spend just a couple of minutes talking about each of the different components based on each of the different approaches that I mentioned earlier. And so the first one, roles, we've already talked about that quite a bit. The difference between the command and control approach and the others is that in the command and control people are assigned, they're given new levels of authority, it feels as though it's over and above what they're presently doing and we know how people can react when that is the approach that you're giving them to, associating them as data stewards. In the traditional approach, people are told that they have a new role, they're given new levels of authority. In the noninvasive approach, again, people are recognized for their relationships and those levels of authority, those are now formalized across the organization rather than being informal, inefficient, and ineffective. In the processes, in the command and control approach, a lot of organizations look at the idea that we might have to do all new processes and all of our processes will be governed where in a lot of the traditional approaches, organizations have a single data stewardship process or even a single data governance process and they call it that, they call it the governance process or the stewardship process when really the process is what the process is. We don't need to change our processes as much as apply governance to them and that is what noninvasive really focuses on. We're going to apply stewardship to the process rather than redefining the processes or have a single process for the organization. In the noninvasive approach, appropriate processes are governed and you are applying governance to them rather than rewriting the processes themselves. Communications is key instead of saying you will do this or you should do this, you start with the approach of you already do this. You're already a steward. You can't really opt out of being a steward if you use data that needs to be protected. You can't really opt out of being a data steward if you're producing data for the organization because you have to have some formal level of accountability for how you're producing the data, how you're using the data. So again, this is a key factor here instead of saying you will do this or you should do this, so if you're already doing this, we're going to help you to do it better. If you've ever heard of the VASF commercials, we don't make the tires, we don't make the tape, we make it better. Well, that's really what data governance and data stewardship is doing for your organization. It's formalizing accountability where there might not have been a formal accountability before. When it comes to metrics and looking at the different approaches that organizations use to approach a lot of organizations look to measure return on investment from data governance or from data stewardship, and that's really difficult to do. And typically what I suggest to organizations is that they look for return on investment in all of their other data initiatives if we're putting money into building an analytical platform or to building a data warehouse or implementing a new ERP system or whatever the major projects are in your organization that require use of data and that's pretty much all of them. You're going to look for return on investment from those investments rather than return on investments from specifically governing your data. At least that's what I've found to be most successful is don't look to put dollars and cents on where governance is making money for your organization or saving money. It's going to be in these other uses of data across the organization. In the traditional approach they typically measure the data itself. What's the quality of the data? How is the quality of the data improved? Typically in non-invasive approaches to governance we're really measuring the advancements of the organization and some of those advancements might include increasing people's awareness of what they do with the data and why it matters.  Think before you define data. Think before you produce the data or am I producing the data appropriately? Think before you use the data that just seems to make a lot of sense and if we can increase the awareness across the organization then people will be more will have a higher tendency to do what's being asked of them when it comes to how they manage data and last but not least in the components in that comparison diagram that I shared with you is the tools and again very happy to have InfoJix as a sponsor of this webinar certainly data governance tools become a big enabler of successful data governance programs and data stewardship programs. We need to record the information about the stewards and what processes they're associated with, what data they have responsibility with but the differences in the approaches that I suggest is that oftentimes in a command and control approach organizations will purchase the tool first and they'll start to try to fit their governance program or their stewarding of data into the tools that they have and that's what I typically find in more of a command and control approach. We have this tool, we're going to use it, we're committed to it, let's fit our organization into the tool. In a more traditional approach typically organizations will look to leverage the tools that they have in house first and that will help them to define what capabilities they have and what capabilities they don't have or should I say what capabilities that they need. So in the traditional approach oftentimes still the tool drives the solution but since we're looking to leverage existing tools first we're really defining the requirements for our organization before we go out and get the tools and in the non-invasive approach it's somewhat similar to the traditional and we're going to build tool kits and we're going to bring in a tool that's going to enable successful solution of our governance program. So I went through each of the different components and each of the different approaches and as you can see it's not necessarily important to stick to one approach for all of those different facets all of those different components of data governance and data stewardship. So when we talk about staying true to the method is it important to pick one approach and to follow that the truth is that many organizations take a hybrid approach where they might be more invasive for some of the components and less invasive for other components. So there's nothing to say that you need to follow the non-invasive approach from suit to nuts or that you need to follow the command and control or traditional approach that way. The truth is that you really need to customize the program to fit into work in your organization and get people involved the way that's going to be most successful within your organization. So the things that I've discussed in today's webinar the first thing I did was I went through the details of the three different ways to manage our stewards and to associate people as being data stewards. We talked about how to select the appropriate way which of these approaches is proper or work best in your organization. We looked at the benefits and challenges of each of the different approaches to either assigning people to be stewards or identifying or recognizing people to be stewards. We talked a little bit about preparing for how the organization will respond to each of the different methods. And then last but not least, we kind of let out the caveat that you don't necessarily need to follow one approach from the beginning to end. You could actually use multiple just different components using different approaches to do data governance. And so with that, after a quick reminder of the webinar next month, so next month in the real world data governance series, I'm going to be talking about data governance in the three levels of metadata. And I assure you the three levels are not the command and control traditional and noninvasive. They're more of a business level or a data I'm sorry a terminology level, a business level and a technical level and we'll go into a lot of detail in that webinar. And that's on September 15th at 2pm. So please sign up for that webinar and with that I'm going to turn it back over to Shannon to see if we have any questions today. Bob, thank you so much and of course we've got a lot of great questions coming in to answer the most commonly asked questions. Just a reminder, I will send a follow-up email to all registrants by the end of day Monday for this webinar with links to the slides, recording and anything else requested. So jumping right in here to get as many in as we can and the time and feel free to jump in with these as well. Do you distinguish data stewards between business steward and technical steward? No, I typically don't although there's lots of organizations that have people that they define as business stewards and technical stewards really depending on what part of the organization that they're in. But if they're a technical person and they're using protected data they're going to have the same responsibilities as a business person who's using that protected data. So I don't typically differentiate but you can, it doesn't mean that you can't do that. I'd be very curious to see what Nam has seen in regards to the use of the term business steward or technical steward. Hi Bob, so in my experience it's terminology right but in my experience the Baker organizations where they have a clear segregation of duty a clear line between the business and the IT then they would differentiate it more but in a medium size of smaller companies where one person wears multiple hats, not so much. That's a great answer. That makes perfect sense to me. What is the difference between a data steward and a domain lead? Well, I'll be glad to address that. A data steward as I said can be typically anybody in the organization that does anything with the data a domain steward typically has a higher level of responsibility so those definers, producers and users of data I consider them to be at the operational level really within a specific business unit but when you get to become a domain steward or a subject matter expert as I alluded to earlier you're now having responsibility for a subject matter of data across business units. So there is a big distinction between what I consider to be a subject matter expert and a domain steward or a person that's a day-to-day definer, producer and user. So I think there's a definite distinction between domain stewards and operational stewards. Who should the data stewards reach out to in case there is a need for escalation? Would it be a executive data steward? Well, and you know what that's a great question and we've done webinars on roles and responsibilities there's articles on TDAN about how I typically define an operating model of roles and responsibilities. Typically the escalation goes from the operational level to the tactical level and then up to the strategic level and so at the operational level you've got the definers, producers and users at the tactical level you've got the subject matter experts. Sometimes the subject matter experts have the authority to be able to make decisions associated with their subject or their domain of data. If they don't have that authority or they don't feel comfortable in making the decisions for that data and it really is something that's cross-organization or strategic in nature what I find is that then the escalation goes from that tactical level of the domain stewards up to the strategic level which consists of your data governance council or your data governance committee. So typically if it's an issue just within a business unit those are typically solved within the business unit but if it's pertaining to data that impacts more than just a specific business function or business unit it gets escalated to the domain steward who again should have the opportunity to escalate it one step higher to the council. Typically we don't escalate data issues up to the executive level of the organization that data governance council is the highest level of escalation within an organization. Again feel free to jump in on any of these if you want to add anything there. I think we have time to add in a quick question here one more question Typically data stores report to data owners from form of council like a DG council or even working group. Those can be different escalation points. I'm reading your response from the other one sorry that's what I'm reading to see that's why I get confused let me comment on that so I don't necessarily always find that the data stewards report to the data owners I mean again the data owners I don't like that term I really think domain stewards or subject matter experts or something is more appropriate if you do have data owners in your organization then stewards are going to be reporting to multiple data owners depending on the types of data they use. I like to keep it instead of the operational level reporting to the tactical level they report to whoever they report to we don't need to change that we just need to help them to improve their relationship to the data. Let me sneak in one last question here to identify both the operations stewards and the domain stewards when assigning roles and responsibilities in the governance structure I would agree with that except for the word assigning because I mentioned that throughout the webinar I would not assign people into these roles I would recognize them based on their relationship to the data so the domain stewards, subject matter experts, they're already the people that you go to the operational people are the people that produce and use the data so it's not really a matter of assigning I would try to stay away from assigning using the verb assign because of what comes along with it. I agree that it's usually that the roles and responsibility in the data governance from a lot of them have already a lot of the activities have already been done they just need to be formally recognized you do the work already might as well take credit for it I like that idea very good I love it and so there's still a lot of questions we haven't had a chance to get to but just keep them coming in if you have additional questions I will get those over to Bob to get some answers for you that I will include in the follow up email on Monday so just a reminder I will send a follow up email with the links to the slides and the recording as well as a lot of the pieces that Bob shows throughout the presentation thank you everybody we hope to see you next month thank you to InfoJX for sponsoring today's webinar and help making these all happen we really appreciate it and thanks of course as always to our attendees in the great engagement we just love the way the community keeps going thanks everybody thank you


Radio Hacking will be 11 o'clock and if you don't realize this is a newbie track I guess you're a little bit more lost than the rest of us I was first to come out with a newbie track a couple of years ago and the idea of the newbie track is Not to insult you but the talks at Defconn were getting more abstract and more technical And it was getting hard to understand one year's track and let's see if all the previous years track So I established a new track just so for introductions new ideas and perhaps things that shouldn't be lined Up with two bracket track perhaps So I thought I'd leave you with these two and hopefully You'll retain us Hello, this is Shatter Okay, let's start this off completely different than most lectures I will give you exactly five minutes to ask me any question you want I will answer completely truthfully about anything you want to know right now without me ask Actually, two minutes two minutes. Good idea two minutes to ask me any question you can think of Yeah, everybody knows everything they want to know about you already know it all that's interesting I'm the team leader with Roots seller one of the things that my company does is We go in and we check both physical and virtual security on sites It's not a lot of people anymore that really do a lot of physical testing which is kind of fun And you'll see it there. We've got kind of a whole little sneakers video of something we were doing last week, but We're gonna kind of do this a little bit different than usual if you guys while we're going through this if you guys Have a question pop your hand up and wave or stand up or whatever I think that the quickest and nice easiest way to do this is if we kind of make this audience interactive versus everybody out there falling back asleep and Come in the end everybody ask for questions and nobody can remember anything render if you want to get that tip come in All right, I've got something that I picked up a couple years back and I honestly It's typically a little bit more flowery than things that I like But it's a little question. I'd like to ask you guys I'm I do have to give credit out. This is not mine. This is red dragons It became off IRC and he was handing it out to any of the newbies that were asking questions And you guys to answer this for me. Are you a hacker take a little quiz today for me today?  This is sound like you You are not a hacker. There are thousands of you out there you buy 2600 and you ask questions You read frack and you ask questions you join pound hack and you ask questions You ask all of these questions you ask what is wrong with that after all to be a hacker is to question things, right? But you do not want knowledge you want answers you do not want to learn how things work you want answers You do not want to explore all you want to know is the answers to your damn questions You're not a hacker. Hacking is not about answers hacking is about the tech path that you take to find the answers If you want help don't ask for questions ask for a pointer to the path that you will need to find out those questions Find out the answers for those questions yourself Because it is not the people with the answers that are the hackers. It is the people that are traveling along the path red dragon There's so many people nowadays because they sit here and they watch the media coverage that goes on with hacking And they look at their little script buddy's that they feel that It's always from point A to point B and then when they hit point B is when they become uber and it has nothing to do with that I Want everybody to stand up right now for me everybody on their feet I know this but get up anyway or not either way This will keep you from falling asleep. Are you ready? We're gonna do a call out here When I say roots you say seller when I say seller you say what already roots. I didn't say that now. Did I?  I want you to think about what you just did Now everybody looks at me with a question face. Why did you stand up when I asked you to? Do I really have any control over your personal lives? Actually, I don't I'm not that powerful only shatter is no Point is is that everybody is so willing and ready to do things because they think that that's the only way people will be happy Because they don't want to be outside of the norm It's one of the things that hacking is it's that you explore the boundaries And if you can do it legally and you can do it safe, then that's the smartest way you can learn out there There are a lot of dangers in being the new script kitty on the block the smartest thing that you can do is if you would like to learn You need to come to DEF CON or any of the conventions or to any of the meetings out there or be friend people But you don't do it by acting like an asshole You do it by being appropriate and professional and remembering that if you treat people nice, let's typically treat you nice one of the same lines of are you a hacker is Something I've always used to describe when people have asked me that question over the years and it has been a few quite a few years I've been doing this and first one usually I respond with I said well It has to do with the mentality Hacker is not something that you simply decide one day and go, you know, I'm gonna be a hacker That sounds really cool and I hear about in the news and well I'm gonna you know get on bug track and learn how to be a hacker because that's what I'm gonna do today So I can read this.org Yes, the The only thing it's a mentality. It's mindset. It's something you do. You don't need a computer to be a hacker You don't need Scripts, you don't need software. You don't need tools You only need your mind for the most part and then everything falls after Have you returned a transistor radio?  The first thing you want to do to it is open up and see how it works. What makes it tick When you pick up a machine, do you look at the software or you look and see what kind of RAM it's running? How fast is a RAM? Can you tweak it to go faster? It's these kind of things that make a hacker. How can you take a? What's one build where the first hacks on the console games was converting a Super Nintendo over to use a VGA adapter That kind of thing that's the mindset that I tend to look for when I'm talking with people or working with them and they're asking if they When they want to be a hacker and I says well, you know, have you done these kind of things if they say no I says well, why are you bothering? Why do you want to do this? There's generally there's You know fame money are these the motivators to be a hacker? So Was loud I've had a statistic down that I was just told the other day and this obviously isn't for many of the big national sources But I'm talking to somebody here at the conference to have a great deal of respect for and they said that 90% of the time Did you hear about a hacker getting busted? It's one of the script kids and you can tell this within the first 30 seconds that you see them in their interview with CNN because they're asking them questions technical questions very simple to where the rest of the world can understand And whoever's behind the camera sitting there at the interview can't figure out the proper way to answer the question So they continue to contradict themselves across the board Um, one of the things that I push with these guys, it's like I grew up in Wyoming Now that my team is here Wyoming has no population to give you an idea how Wyoming is But one of the things that when I was growing up is I thought I was just the absolute little badass And I had to go out and destroy everything I could possibly get my hands on and I got this nice little rep And I just thought I was so cool and then this thing happened one day and I had to grow up And when I grew up the problem was is that that rep didn't go away And I've been working three years working very very hard and trying to be very professional to get people to understand The reseller is what we're trying to do and we're trying to be positive and I Still have people in my own hometown I just spoke to Microsoft conference the other day and my throat was slipped before I even walked in the doors They wanted me to come in and do a demonstration I walked in the doors. They say you're not allowed to touch our computers. You're not allowed to touch your network You're not allowed to touch our phone system. You're not allowed to touch this. You're not allowed to touch that These are people that I've worked with for years that should be able to trust me and they would not let me even go in and check my email So I made it very hard to go speak to Microsoft conference when I wasn't even allowed to have my own laptop there Another thing that I Bring up is that you remain stupid if you use others codes It doesn't really make any kind of sense For you to go out and try to be a script kitty It's cool that if you're downloading somebody else's codes or using somebody else's exploit That's a good thing But you need to study the code and look and see what they did not just compile it and use it Compiling is the absolute wrong way. I enforce something very heavily with my guys That's called learning versus compiling and there's this beautiful thing that they make it's called a book You can pick these up at your local library and they have so much knowledge in them You can sit down and get something like pro in a nutshell and learn this stuff in days If you really try hard at it instead of spending four to five years Trying to stumble through somebody else's code trying to figure out what they're doing and realizing that the final product We'll just get you you know, we'll allow you to take control of the box By the same token, there's there's another time that there's no sense in rewriting award hour. It's been done There's plenty of them out there. There's no sense in writing a new port scanner. Those are out there So in some sense, there it's it is redundant to go out and write the same tool However by the same token, you should know how that tool works. I understand when the tool is used and why the tool is used and This is the problem with a lot of the things right now that you know, you can get online You can get on the web you can find the latest exploit you download a patch You hack it or you compile it you run it and you've now owned a system or defaced a website. Is it hacking? No Not at all. Does this impress anybody? Maybe your friends or someone who has no knowledge of anything But anybody that has any real talent or works in the industry will not respect it. It's not skills and it's not anything to be proud of along the same lines with us to is There's a lot of pretense that goes with the script kiddies They they attempt to go out and impress people talking about skills.  What skills do you have?  These are It's instinct. I have instinctive skills. Yeah, you know Anyone can learn how to use a search engine and find something. This isn't skill Exploiting a system after reading bug track is not skills Finding the new exploits can take some skill other times. It's just pure luck You stumble across something and you find it. Hey, this is kind of neat. Wow. I remember one years back to me it's about six years ago local The college had Internet dial-up access. They had two inbound lines and those tend to be busy a lot Well, the library system on the same campus also had dial-up access Well, we found the way it had an automated login script. Well as it was logging in we found if you just started hitting a lot of control G's Suddenly you would get a telnet prompt and you type You know type in your new address and now you're back at the school system you want to be at So now you can believe bypass their dial-up board that got used for a while and We eventually they found out what we're doing and then so we would found you found yet another hole and all they were Doing was simple shell scripts to connect from a dial-up into the system Some of the things too was we also found that From the same library system if you telnet it over to the actual public library system you came in under an anonymous account and It looked like you were rooted the system. You didn't have full root access But you could start sending out email to people so some of the spoof males that went out were rather humorous at the time But again at the end of it after we had our fun and played around with it. We did type up a rather long Kind of an overall and let the system sys admins know that okay. Look here's the problems Here's what we found and we've gone in and listed out the ways I could fix it and they did take care of it A few months later One of the local script kids decided that he had heard that we were going into the public library system he decided to come in right behind and Since there was some word of mouth things he stumbled into it and We had told him where to lay every trap to find somebody coming in to do this again sure enough He was caught he was arrested and the press had a field day with it having fun and he said in an interview telling the press how he was really hacking the system to provide the access for his friends to go on the internet and The key files he was deleting out of the Operating system was to make it run better In the same article the Admin of the major ISP of the town as well as the person who had set up the internet dial up for the college They kind of did an alternating paragraph and every time this guy would list out why he was You know for taking down the entire library system to make it run better this guy was saying well I don't understand why he's deleting these binaries. You know, these are key components of the kernel to run and compile And in the end You know the kid still to this day is working at the 76 gas station. That's his job Hey, you know, he got his little 15 minutes of fame and you got to run around tell everybody that he was you know Mr. Hoover hacker and That's what he does now he pumps gas and Meanwhile everyone else that was around And that had worked on the original system for letting him know what had happened various pro coders admins making you know the upper six digits and I've kind of have the other one office and they're still to this day hacking on code working on, you know different tweaks to systems and in streamlining and That's part of the difference between scripting compiling and learning and writing You script you compile And you're you know, it's short-term it's instant gratification and it will not get you anywhere at all One of the smartest ways to learn things and this is why Deathcon is such a wonderful thing is that you have the opportunity to meet some of the absolute best in the world While you're here in Vegas It's very important that you ask professionals these people if you run up asking for their autograph They're probably going to look at you quite oddly You got to realize most of these people spend a large majority of their time in wire closets And they don't talk to anyone and then when you come up and you're freaking out And you're trying to make them some big media star icon these people get very nervous I wrote down something here that I thought was a pretty good Way to describe it for a lot of people that don't still don't understand is that I used to box and I did Golden Glove and I thought I was just a little I thought I was the best of the best In my town because it's you know You've always got this nice little pool and you think you're all big and bad and I went and I started training with Cesar Hogan, I'm not sure if you guys know who he is But he is a professional boxer now guys amazing and I found out very abruptly and quite painfully that I was nothing But I trained with him and his brothers for about six and a half months And I actually got to put it where I could keep up with these guys And it was amazing that over three years of studying boxing and constantly working and constantly keeping in shape That I'd only gotten to this one point when I started working with the guys that were so much incredibly better than I was in a period of six months I had like Surpassed anything that I could have possibly wanted to do on my own While you're here the smartest thing you can do is come in if you see somebody that you notice or you recognize a name Or their face or whatever Relax take a breath sit down breathe and talk to these people Everyone here at Defconn is very approachable Chatter and I were at 3 30 in the morning the other day we're sitting Thursday Thursday morning had a gentleman come in and You know we were joking with this guy a little bit but nothing mean at all And essentially by the time things were over this kitty who nobody has any idea still Who this person is is essentially chest to chest with Shatter trying to get him to fight Now the point is this one that's stupid to fight Shatter because Shatter is a pretty big boy The other thing that's stupid about it is that This guy's not making friends that way he comes in totally acting like he's some little gangbanger which doesn't fly at this conference and Ruins any chance that this kid has had of becoming friends with either of us Got the same token at the same time at the same time as this is going on and I'm chit chatting with him I'm chuckling he sees you know trying to insult me Making various threats and posturing and gonna throw down and kick sass or whatever and I'm giggling and laughing and inviting him Just get a drink. This is Vegas. We're here to have fun. Let's enjoy get a drink. I'll buy you a drink I don't care. Let's sit on have fun. I don't even know he never even introduced himself First thing I have his mouth was walked up and said yo y'all hackers and When we start laughing is all we must be cis admins because you don't want to give information to nobody admins are always assholes. Yeah, I mean this is the way to make friends and influence people I mean you guys are I mean, we're not kidding. This is not made up By the same token as he walked in and picked me out of the bar to start getting in my face Pyro is next to me. I had another friend pimped over there behind him was fatal and there's two or three other guys I'm pretty good friends with in the bar at the same time, but he's completely circled by But you know, he walks right into the middle of this and just starts. I Don't know why I don't know what motivated it. I don't know if I was supposed to be impressed I wasn't and now we get to use this as a lecture example It's a beautiful one and you can see this kid Honestly was pretty new at things, but the thing that was frustrating You know the question that came out of his mouth after are you a hacker just before he really starts to throw down is So y'all down with CDC, right? That's like We get along just fine with the guys But yeah, exactly. That's right But you know we answer that way. He just this kid completely goes off This is not the way you don't come to con and act like this and expect to learn anything This kid's already on an ejection list of anybody sees him He's automatically ejected because I guess last night he was out in the lobby picking fights with people again If you're coming to the con you would like to learn you can approach anyone I was walking last night Goldstein comes walking by and these kids like harass him for about 20 minutes trying to get him to get his autograph No, I'm not sure if you know him personally or not. He tends to be pretty quiet guy He tends to be pretty laid-back He's one of the nicest guys on earth that you could ever meet Which don't go up and get in his face and shove a pen up in his nose and say would you please sign not a graph for me? It's just not the way you do things here at the con about the same token there's others there's you know By just relaxing and hanging out and being social you'll meet the darndest people I'm walking in the back hallway yesterday and a guy comes up to me and says excuse me I have to wear my goonshirt at the time So that kind of singles me out for people to approach a little more nonetheless and He hands me a card and I kind of look down I'm kind of glancing at it and he says this gentleman would like to come out and do a question and answer And he's here right now. I'm kind of okay. We call priest as I'm talking to priest I look and I realize that the seal on the card says director of the CIA and So the guy comes by and chitchat with a minute or just in the priest and then they later have the big Conference yesterday and you know he was though when I taught when I first saw him He was sitting like no he could have been like what about here in the middle Sitting in his pole shirt smiling and watching the lecture that's going on these people are among you and you can walk up And talk to them.  Well? How did you do it? Well, that is utterly amazing and meanwhile you're saying you're giving a full confession to something Yeah And that's another thing. There's a lot of people that want somebody to spot us a better They think that there's a group of feds there. They instantly like blacklist these people They're here to and you know what if they're working for the federal government, and that's what they do for a living They're usually very intelligent people. You should sit down and talk with them Everybody see the gentleman from the Air Force that got busted yesterday I sat down with him a clone and I from hack Canada We sat down and discussed and just talked to this guy for Probably good 30 35 minutes with this guy, and he was great You know, it's one of the things like I said if you are here to learn the greatest thing in the world You can do is go out and grab somebody to drink and sit down and just relax Right now because of the media coverage that is happening typically the large majority of the exploits that you're saying that are going on out There are the web-based people taking down different websites and everything and it's you know That's fine. If you've got some message to deliver, but please you spell checker and Be used to have the common decency to back somebody's side up if you're going to exploit it I mean you should put a little separate directory off to the side and let this is admin know that you've done this Because there's no point that you know how pissed off I get if I've worked on something for 36 hours straight without a shower I come in the next morning some 14 year olds knocked it offline just because he could It gets very very frustrating. Yeah This can also lead into another one.  You know 3 a.m.  You're doing something right or it's just pure Naivete is One it's a mentality. Are you with intent maliciously going out to destroy something? Are you trying to gain access to a system in order to go in and ruin it and? That is what I consider to be the problem is when you are trying to go and ruin something defacing the website is not an Example of your skill With a few exceptions that I've seen done and they were done well and to this day people still haven't not sure how They got it and did it My like I can I'll cite the New York Times hack that was a beautiful defacement. It was well done. It was well thought out No matter how many times they fixed it It would mysteriously hours later put itself back to the hacked version and it took them better part of a week to get all of the little pieces of code and crowns jobs and Worms and anything else floating around the system out of it. I mean they completely littered the system with little tiny bits Of code yet. They destroyed nothing All of the site was fine. It just was a nuisance and it was very well done but Those those are those are few and far between those come around once a while once a year once every two years More often than not you hear about, you know major things like dosing, you know, I I cannot Go so I cannot keep saying getting tongue-tied. I cannot express enough how much Dossing is just it's it's wrong. It's crass There's a theoretically no real way to protect against it unless you have bigger bandwidth. That's it.   He some Burt IRC kiddies got annoyed and decided to start start flooding his He was on DSL at the time and they not only took him out They took out the ISP and they took out a good chunk of of major networks throughout all of Seattle Then it was taken down for a good 18 hours simply because of who he was dating Nothing else he had done nothing to anyone it was just IRC talk and these guys Retaliated because they're gonna show him There was in the lobby last night was based off of an argument that had occurred on IRC Some major news for people IRC is fake. It's not real life You don't have to come to the con looking to pick a fight with somebody because you argued with them on IRC typically 90% of us that are IRC are there to have fun and That's how we do it is by getting under people's skin But you're not supposed to come to the con and threaten people and get in this massive fight with them I should give you an example about looking in somebody's door. Oh, you know Changing gears again this little bit. So the thing goes in with the defacements I was thinking about it one day Because I kind of consider the philosophy of the whole aspect. I mean everyone talks about the technical skill I a lot of times think about the philosophy of what we're doing the the Humanity issues and repercussions a Lot of the defacements I've seen I'll check them out on nutrition and see what you know What's been happening lately and I see a string of them all from the same group You'll see like 14 defacements that day and all they really did was they found an exploit and they systematically went down a string of websites and were probing the system to see if it was open to that attack if it was they Went in the script automatically uploaded their version of the page and moved on to the next one They weren't even at a keyboard they didn't need to be they could just let this this thing run at night And it will go through a deface for them and they can you know claim they have skill with this And they're hitting these websites that are these little tiny mom-and-pop domains That could just be some guy's personal website. It could even be something as horribly insecure as a Windows 98 web server This isn't a this is not a hard system to take down. I you can I mean a shares attack will take it out in 15 seconds but You know how easy it is it to walk up to a five-year-old and punch him in the nose Mean this is not anything difficult and I kind of attribute it because they the explanation that they give every single time Is their justification for the attack into basement was they should have had better security? Trying to help them out by taking down their side. Yeah, we're gonna teach them a lesson and show them that they need better security by wiping them out Because I'm here to teach him because I've got skills. I've heard this. This is quoted. I'm not you know I've heard too many times And the example of this of someone needing better security is if I'm walking down the street and I see your house And I walk up and I put my foot through the door and I now take the VCR I'll haul the TV. I'll search for some cash takes and valuables and I'll even know it saying You should have had better security You should have had an alarm system on your house You should have had a full steel door with a metal frame with two inch You know one-way bolts on it as well as a full video surveillance system How about though we could mind we could put landmines in the front yard barbed wire around the house and have running dogs And electrify everything is that enough security to protect your house for me put my foot through the door and By that same token, why should you have to put up that kind of security to protect you from me? It's it's not right So that's that's one of the reasons these defacements really just annoy me and they just get me angry because there's their crass They're not it's not like you attacked a you know a high-level firewall bypassed it in and gained root access on on eBay say that you've now owned the entire eBay cluster It's nothing like that. You're going in and attacking a very small single system That's either based out of a home or a co-location situation more likely so you could be probably a home-based DSL or partial T1 or something these aren't hard to do and Just because it's easy to do is by no means grounds that you should do it The next one I have up there is developing a rapid. It's kind of it's a Little bit different. I didn't really want to come across that way But I didn't know another way to phrase it anonymity is a great thing if that's what you're going for that is perfect But if you're trying to be a security professional, you need to develop yourself a very well-known positive reputation the only way you're going to do that That's one of the reasons I asked that question at the game I asked you said you know I'll give you a few minutes ask me any question you want about me and I'll answer And at that time I would have I won't now I will not tell you some of the things I have done That was the time to ask it, but I have been doing this since I Think I got started actually doing a freak I was originally doing freaking back in 82 83 sometime around that and I didn't have a computer at the time And you know I discovered the really neat way to make a lot of free long-distance telephone calls, and it was fun But that's in token I have not gone around bragged about it I haven't written all forms of text files and such and tried to gain as much notoriety as I can because of it It's something I did it's something I was doing and For many years. I wasn't even aware of anyone else was doing it I thought maybe I'd stumbled on something really kind of neat and cool I'm keeping it to myself or once in a while, you know punching a code for a friend, you know, I just do that like I just know but The norm lately of the last few years has been to do something and then talk about it, you know Get IRC and bragged and bragged to everyone and anyone that will listen about what you've done Especially the federal agents it seems like yeah, because you want fame because you want reputation and You know that's kind of long-distance. We're going with this aspect point is is that whether or not you are going to be Black hat or a white hat you should always try for a positive Reputation if you're going around telling people how bad you are because you think you can You know this.  They're trusting you with their network Always try to shoot for the for the positive image and it's very important to Defconn to do this You will have cameras in your face everywhere No matter what you're doing at Defconn There's probably a news crew around somewhere because Defconn has became increasingly popular with the public Very very important thing is to present Defconn professionally It doesn't matter who you are what part of the world you're from what your style is what crew you're from Whether or not you're black or white hat, but present yourself professionally because you are going to represent every single one of us And there are a lot of people that are going to be extremely pissed off if you go up there and try to act like some Little badass and then can't answer a question if it's asked We're gonna really start moving here because we've got a lot of people flooding in I think we're running short on time Yeah One of the things I got on how to learn there's an old standard trick There's this great collection of books called the rainbow books and the granted large majority of the information out there is Really behind on time, but at least look these over see understand what people are talking about when they're using different terminologies other one along the same lines of doing your research is There's There's kind of the old Some of the old Frank faces like you know those those who forget the past or do to repeat it Well, that's the same in computers I've I've seen over my years of doing things that I've seen cycles come and I've seen Some real I mean I mentioned a control G hitting it a bunch of times at the at the system to gain a telnet from We used to do the same thing on the bbss You could you could fire a bunch of controlled characters at a system and suddenly you crash the bbs software And you're sitting at a prompt on the guy These old some of these these old really stupid things will sometimes work again And you can you can learn a lot by sometimes looking at the way things used to work And try to take that old simple approach like the old black box. That was simply nothing more than a resistor That same aspect can be used again possibly in a different Angle but be used again to apply to more modern technology The more complicated the machine the more likely there are things to break on it and sometimes A stupid little thing that no one would ever think to try may do it Um General servers bug track and t security infosec Any of these these are great to be on and granted you'll probably receive about a thousand pieces of email a day The point is if you flip through and just look at the subject line It's a great way to learn because it keeps you pretty close to the cutting edge Um and come to cons talk to different people like this Uh next next section we got up there is hacking without going to jail Um, there's a lot of people that seem to think that the only way they're going to learn how to hack and Learn computer securities if they go out there and try to do it where they're working or to one of their enemies or whatever Go to your local libraries go to your local schools Typically they have old 486 machines sitting in a closet.  It's 110 legal You can do anything you want to it without having to worry about hurting somebody else or without having to worry about going to jail Let's keep on going Okay, what else we had there's there's Take advantage of uh free word and open source Everybody's handed out At the conference. I mean they're passing it out left and right and it's a great way to learn Yeah, so yeah, we're gonna wrap it up because we got the next crew coming in. Yeah, so well. Thank you guys