Welcome everyone. This is our module three session on generating threat intelligence from an incident. This session uses data from kill chain one, which will be made publicly available, and demonstrates how we can generate in generate intelligence from an incident or intrusion and use that data internally. Advancing the slides. So, we will touch base on our objective. And we're going to iterate we're going to run through the CTI life cycle here. We're going to start by touching on our stakeholders requirements goals and objectives. And we're going to get into the CTI analyst role during an incident and talk a little bit about processing intrusion data and information. And the bulk of the conversation really is going to be around analysis and production, the research and elements to include in a CTI report. And we'll touch briefly on dissemination how we're going to share this and you were going to share this with, and finally we'll wrap things up with feedback and evaluation a critical step in the CTI life cycle and CTI program in general. So we'll, we'll touch base on that here as well. The objective is really straightforward. We're going to demonstrate the important role that CTI plays both during and after an incident and moving right along into planning and direction. I'll go ahead and pass it over to Stephanie. Great. So we're going to do an overview of the stakeholders in this scenario.  We have people sitting in the SOC. So the defenders, forensics team, instant response malware analysis and threat hunting teams. We have SOC management and the IT team. And this phase of the CTI life cycle is where our requirements are created. So we can see here in this diagram, some of our goals and objectives. So we want to identify blind spots in our network, how we're getting attacked so in our endpoints network platforms. We want to understand the adversaries capabilities. How are they attacking us? Why? What is their method of attacking us? And we want to also call out explicitly any new kind of defense mechanisms we want to create because of this CTI life cycle we're going through. So those might be new detections we write, new threat hunts, new purple team test cases. So those might be explicit test cases you run with your purple team to check if a certain blind spot has been covered or not by your defenses. And while performing research isn't necessarily a stakeholder requirement, the CTI team should be digging into those IOCs to find new information that they can use to inform the various teams. So we can use different tools and analytical methods for this kind of research. And back over to Clay. Alright, so yeah so touching on collection here. Right so artifacts will be collected from different teams that are going to be involved during the course of an incident. This will be our IR team, our forensics team, and even our malware analysis team who might get some artifacts from the forensics team. So all all of these teams work together and there might be, you know, some people might be on multiple teams. So every organization this will this will look different. So additional data and information will come from external sources through OSINT on existing data. So OSINT includes sources documented in our collections management framework or collection management framework that that we've created. But we'll also include sources that are discovered through the process of pivoting, which we'll touch on in a little bit. So existing data plays a critical role during OSINT. When we're pivoting when we're using open source intelligence. We might not know what data source we're going to run across that might be useful. For example, it could be as it could be an article or a in depth malware analysis report that we find useful. So during OSINT. Yes, we'll go rely on our platforms that we're aware of and that we've documented in the CMF. But at the same time we're also going to be performing research that's going to lead us to new data data sources that will pull those in as well. I just wanted to note on all of that processing. So this is the next phase in the CTF life cycle and we'll be using intrusion data and information for this. Now every organization will be different and depending on the level of maturity the organization has this could be very limited or quite verbose. Tips are commonly used so the tip is a threat intelligence platform for processing and open CTI is a free and open source platform and here's just a quote pulled from from their website. And yeah it's a great way just to structure store organize and visualize technical and non technical information about threats. Automation of data from a tip to a sim is another commonly implemented process. And as we're working through these events or intrusions the daily work we do. Look for opportunities to develop this phase of the CTI life cycle and ideas will come at random times. You never know when an idea is going to strike or present themselves. But make notes document those and you know that way it'll you'll you'll make improvements along the way. So now we'll get into analysis and production and for that I'll kick it over to Lucid. All righty. So analysis happens during and in support in during an incident, and this could be to support other teams, and it produces CTI that will actually be in reporting. And the CTI team can really add value by analyzing OSINT. So we're moving through IOC's like was was already mentioned, you know an open source intelligence can be visualized and analyzed a lot of different tools platforms and models. And I'll have a demo here of a couple of those tools virus total and any run which provide sandboxing and visualization of IOC's. I just want to highlight a couple of open source intelligence tools that we can use. Maybe if we have an active incident and we've been provided some IOC's, we can see what's publicly available about those those IOC's and see if we can discover infrastructure or tactics or other things that could help us to help the other teams in incident response threat hunting to respond to an incident. So in this case, the situation is that the incident response team has provided us with a domain. A user has clicked an attachment and an email and it really wasn't what they were expecting. And they reported it and firewall log showed that this domain baseball charlamagnelegardier.com was contacted. So we do a little bit of Googling first. Okay, this looks like might be a real maybe French baseball team. So maybe this site isn't infrastructure that was set up by a threat actor could have maybe been compromised if this is really a malicious site is suspicious at this point. We can see an alien vault, which is another provider of open source intelligence shows that this is probably a WordPress page. It's got this WP content in the links that we see here, the associated URLs. So maybe it's a compromised WordPress site. We'll see maybe we'll see nothing. When we look at virus total virus total sandboxes URLs and files that people upload and then comes up with a report essentially of all of the behavior from those executions. So if we look here, we can see that the domain itself is actually considered malicious by some security vendors six out of the 94. As we go through the tabs, there's some more information about the domain. Some relations. This is really with bread and butter here virus total where it shows some of the behavior and and other relationships between this domain and other files. That contain this domain and their tech in that in the file itself files that when run communicated with this domain. But really the best the best visualization of all of this information is to use the virus total graph. Now you can create this graph after setting up a free account and we can look right away and see, okay, something must be wrong. There are in fact document files that communicate doc and XLS Excel spreadsheets that communicate with this suspicious domain. Now we already have more information than we started with. But we can start to look over the graph and we can see that these documents are considered malicious by security vendors by different antivirus engines. And we can really start to pivot from here. We can find a document that's considered malicious and see what its other relationships are and expand those out. These aren't expanded right now. So for instance, if we expand domains, we will see that there's some other domains that get contacted when this document's opened. Some of them are related to Microsoft. So those might aren't really suspicious. But there's other ones like this domain tango with Colette. And we can really just continue to expand because if there's there may be other documents that also communicate with with this with this domain tango with Colette. So we're going to find some additional documents. So this might give us, you know, tango with Colette. That's a pivot to infrastructure from and we pivoted from that infrastructure potentially to more tactics to abilities that the actor has based on, you know, the the results of these are executed in the sandbox. This is already a lot of information that we could pass back to the other teams. We can really keep going. We can look around the graph and see that there is also this PowerShell script. It's not quite obvious from looking at that it is a file name that it's PowerShell script. But we could see that it is executed by several of these files that communicate with the domain, the suspicious domain that we've been given. So maybe our teams are going to start looking for PowerShell scripts in their in their tools, their on premise tools. And another thing we can do is that we can take a document that is has relations to this, what looks like a campaign. And we can run it through any run. Now any run is also a sandbox, but it will show and play back it was interactive. First of all, when you run the file, you're able to interact with it in a virtual machine in a sandbox. But then after the fact, it creates a report and a link back to that session shows what happened in real time. So in this case, we can really just look back through all the public tasks to see if a file of that hash was run through any run. Now we can see that there's a bunch of different runs. This is a historic campaign from a threat actor Lazarus group. And we can see that some of these may be more or less complete as far as whether it act the files actually reached out and downloaded a malicious payload just in that there could be all kinds of reasons for that. But this one here is probably the most complete run. And we can see on the right here, the exact timings of the fact that Windows Microsoft Word ran and that exploit of some sort caused this power shell to execute. And we can see more information about this power shell itself and all the different events that happened as a result. We can get a PCAP that's actually a capture all the network traffic that was generated from this session. We can see all the connections here and look through them and see if there's any other domains maybe that we missed when there's actually this towing operations. There's another domain here that we actually didn't miss. I don't know that we necessarily saw that on our graph over here. So, as you take bits and pieces that you get from one tool, you can put them into another, and you can find out more information that you can pass back as a list of IOCs to be very useful to threat hunting and everybody else that's responding to an incident. That is my demo of virus total and any run. So this graphic focuses on the production element of the phase. And this can be a template it's just it shows some of the things that go on a report it's not doesn't limit you to just these items. You know the graphic section doesn't just show all it's not live doesn't you're not limited to these graphics, but you could put things on there like a multi graph, or just diamond model. But this is a good visualization of all the things that would go on the report. And you're thinking about with a complete report does it tell, or if you're thinking about whether to put something on the report as completing it you're trying to ask the question does it help to tell the story. So, one of the things from the previous slide the diamond model for intrusion analysis. This can be used both track contract both fail or successful intrusions. And it models the relationship between data points. And it helps with pivoting testing theories about how things are connected or how an intrusion happened. So in this example, the anti virus on a endpoint within the organization detects a scheduled tasks that might be suspicious. The information is passed a threat hunting team that discovers a mal doc malicious document that communicates with infrastructure you see on the left of the diagram. We're able to resolve that IP to a domain name, and that domain name we don't know who the adversary is, we're just going to use it to define our adversary. So because we had malware love that XYZ. We're just going to call this cluster of activity. And we can do this use this model to perform analysis periodically, whatever schedule makes sense for the organization. The other way to show the data. An intrusion is an intrusion summary. This is just a listing of all the different data points from the previous graph same information. The intrusion summaries inside an organization are really the best source of intelligence show what's actually going on with that company with thousands of attacks going on outside of the organization data, even in a single day. And the diamond model to visualize the data points from the summaries. And then you can start to see clusters of activity emerge from this process of going from a summary to a way of modeling or visualizing the data to starting to see patterns. The MITRE attack navigator. This is a web based tool. It's free for annotating and exploring these matrices. You can visualize your defensive coverage plan for red or blue team activities purple team. And this is this this visual is a heat map of TTPs that were part of kill chain one. This is an example. We, there's not every, not everything that happened in kill chain one is on here. Not all of the little sub methods are on here. You'll be able to with a read. There is a link at the end of the presentation, or you can just search for this attack layer navigator and fill this out yourself. I will turn it over now back to clay. All right, excellent. Thank you. So here is an example of a Maltego graph. Maltego is a link analysis tool that we can use to pivot and to define additional data points, information and context. This example demonstrates how we pivot from an IP address to a file hash. So the file hash that I'm referring to here is the one that is tagged as sandstone malware. Just made that up. Malware has been attributed to a threat group. We see stardust kalima reference there, but it's also associated with another IP address, which has another website or URL associated with it. So all additional context. So now what? Well, the IP used in our intrusion can be associated to other pieces of malware so we can see that. So this should be investigated for additional evidence. The malware we pivot to or pivoted to in this example was not found in our environment. So it is possible that another adversary is using the same infrastructure. Right. So for the reverence is required in order to be able to identify that or apply some sort of level of confidence as well. So I actually added addition another piece of malware to demonstrate that there are two pieces of malware in this scenario now so it there can be different scenarios that come about but just wanted to highlight this other possibility where another piece of malware was identified. Using that IP address or that IP address was serving up multiple different pieces of malware there. And another one was identified, and it is attributed to a different threat actor. In this example, it's noted that the limestone malware is has been attributed to hidden cobra. So for our example and demonstration purposes for kill chain one. Two different threat groups using two different pieces of two pieces of malware have been associated with that with that IP address and each piece of malware is associated with the different threat group. Now one thing that is interesting is that hidden cobra and sardus kalima are are attributed to North Korea. So, we could say with high confidence that our intrusion is associated with North Korea. Now, for Magnus Tempest attribution is not one of our threat intelligence requirements, maybe it is for your organization. I would argue for most organizations that attribution shouldn't matter. What matters is the intrusion right, who cares, who did it, how will, how would knowing the adversary change anything you do, would it. I would argue that it wouldn't perhaps another discussion for another time, but since attribution is not in what one of our threat intelligence requirements, it's an interesting observation that we can make. And an interesting observation that we can include more an interesting assessment maybe that we can include in our CTI report. Yeah, it could be useful for other things as well but I would really demonstrate that Maltego can be used for for pivoting finding additional information and providing more context around an intrusion. And with that, I'll kick it over to Stephanie. Great. So, these last two sections will be about dissemination of the information and the feedback and evaluation. So dissemination here in this kill chain specifically since all of our teams were involved in the incident. They're already aware of the outcomes and aside from the report being generated and being delivered to our stakeholders. We don't have anyone else that we have to update about the incident right. There's no other dissemination required in another scenario if there was a team that wasn't involved and was not a stakeholder. So I want to think about how to distribute the information to them and what they need to know about the incident. So next we'll talk about here just an overview again of the stakeholders in this specific incident so we had or the specific kill chain. We also had the executives management it team and then members of our sock on the right. So next we'll talk about feedback and evaluation and a method for evaluating your CTI life cycle. So here during the planning and direction phase, you want to make sure you have defined documented and socialized processes for feedback. You don't want to be, you want everyone to know how to provide feedback.  And you want really ongoing feedback you want it to be readily available people to give feedback to you. And once you receive this feedback, you want to evaluate your processes so you want them to be complete, accurate, relevant and timely. So we'll talk about these in a little bit more depth so you want to complete. The CTI information intelligence provided to be complete. So, does it have enough information to generate a proper response. So how comprehensive is the intelligence are all of the data attributes present. Is there vulnerability analysis.  So this comes back to like your intelligence requirements at the very beginning. Were you able to capture all of these and did you deliver. Was it accurate. So were there errors in your generated intelligence, you know what data sources, did you use where they accurate. Was this the most up to date information, or were there information changes along the way. And is it time bound is there like an expiration for this intelligence. Sometimes if you if you provide information about specific IOC's those might change very quickly. So it's important to note, if it's time bound and how long this will be accurate for. Okay, so now we'll talk about, is it relevant and is it timely. So your intelligence has to address the relevant threats inside your organization and be delivered in a way that allows for effective action, right so does it map back to your original intelligence requirements. So how do stakeholders submit requirements and provide feedback for more relevant intelligence. And is it timely has to be produced and delivered quickly. So it can be used fast enough to make a difference. So, how is it delivered to ensure quick consumption is it delivered by email, etc. How long between the discovery of a threat and notifying the stakeholders. So is this is this intelligence released to the stakeholders, as you go along and you learn more, or is it at the very end. So that's it for feedback and evaluation and I'll pass it back to Clay. Alright, thank you. Thank you, Stephanie. Yep, so here's some resources that were touched upon in the presentation. Thanks for watching. We joined the conversation on discord here. This is our discord. There's also the defcon discord that that folks should be in will be monitoring those channels as well. So please engage there. And wanted to call out that we, we did create a module one session, and that was released prior to defcon. So, if you're unsure about any of the content in this, in this module three, be sure to refer back to that that module one session that is available and up on YouTube. So, thanks again, everyone, and look forward to engaging in the conversation and see you in in future modules. Thank you.


It was going to be a memorable day for Brainerd tennis today, no matter what happened. Either they were going to win the Section 8 AA team tournament and make it to States for the first time since the 1970s, or they were going to lose and their undefeated regular season would be all for naught. They faced their rivals St. Cloud Tech and it came down to the last match, third doubles which went a dramatic three sets. Matt Hintz and Camden Cooper in the third set in the tie break need one more point to seal the deal. They lost the first set six to nothing and fought back. Camden Cooper plays up on the net, swings with the weight of the team on his shoulder and delivers. They win in dramatic fashion. The team rushes the court, hats in the air, they knock off Tech. First time this decade St. Cloud Tech isn't going to state the first state birth for the Brainerd Warriors since 1975. Here are the winning players for Brainerd in that dramatic 4-3 match. Tanner Lumberg easily wins first single, Stephen Lowe the win in second singles. Pat Morgan and Ian Odland take second doubles and as you just saw Matt Hintz, Camden Cooper's Camden Cooper the dramatic win to put Brainerd into the state tournament. If you enjoyed this segment of Lakeland news please consider making a tax deductible contribution to Lakeland PBS.


Hey guys, Merry Christmas. We're here doing the BFF challenge Christmas edition. I'm Ella Mastro Antonio. He would be gal Alex Huln We're just in the club shop, so yeah, yeah if you guys want a little present someone special pop in and you'll get a bargain I Don't even know what I want for Christmas. Oh What'd you say? I do want one Yeah, you do I said a holiday because I didn't even know what I wanted, but that is what I want. Oh Actually I know what you want. Oh, I know what you want. Oh He's pretty depressing that it's over. She turned three, two, one You have real D. I said a box of mangoes Galuzzo's Come and visit us in North Epping shout out You know I'm the Grinch, so it's like every presents pretty lame One two three Okay, I said thank you Was a dig at me or Christmas Pasta, I mean I've done I had like a Zanya for Christmas and stuff. Do you really? Yeah Hey Carol, sorry I don't even know any of the stuff I had. I only know one it's like my favorite Ready three two one That is what I am. It's the only song and I hate it so much for every Christmas I want a lot for Christmas. There's just one thing. I need I Don't care about the presents I Just want you for my own more than you could ever know You're wearing a no-look All right, three two one. Oh He's had a song of a very merry Christmas. Okay. Now. She has to sing it for two bonus points to take the lead love easy Last But the very first day you gave it away. This is harder than a book People this year to save me from tears Give it to someone All right guys, that's it for the Christmas be a theft edition. It was a draw, but we all know who actually is the winner Thank you for tuning in Yeah, and have a merry Christmas and a happy new year and then hopefully we see you guys at the Sydney Derby just this Friday on the 20th at Bank West Yeah, see boys there


Hey everyone Chris here from IELTS Advantage and in today's lesson we're going to look at IELTS preparation how to get the score that you need in the fastest possible time. Everybody wants a certain IELTS score and nobody has time these days so what we're going to show you in this video is how to avoid spending a lot of time failing the test over and over and over again and get the score that you need in the shortest possible amount of time. So if we look here this is most students all right most students doing the test are sad because they try and do the test and fail and then they fail again and then they fail again and they fail again and then they fail again and let's say that this is over like a like a six month period which takes you know extremely long time just failing over and over and over and over again but what we do with our students is we show them exactly what to do and then they get the score next time so why are our students getting the score that they need and most students are failing continuously that's what we're going to show you in this lesson so we're going to show you how to avoid these things and get the score that you need in record time so let's have a little look at number one so most students why they fail the first time is they rely on tips and tricks and shortcuts like if tips and tricks and shortcuts worked then I would just give you tips and tricks and shortcuts that's what I would give to my students unfortunately they don't work the students who get the score that they need first time they do something called deep learning they learn things properly they're not looking for shortcuts and hacks and tips they actually look at things in detail and learn them properly because you can't cheat the test with these tips and tricks let me show you an example let's say that somebody wants to improve their vocabulary well if you go onto youtube the most popular video on aisles vocabulary teaches you five words that will get you a band nine now this video is nonsense it is designed to get clicks it is designed to get subscribers it's to improve somebody's youtube channel they don't care about your score there is no way that you can learn five words and then get a band nine it's just nonsense what our students would do is we would learn ten words a day by reading every single day reading english every day and then noting down new words and all the information that they need to remember them and use them in the test and then reviewing them regularly so this requires five minutes and this requires probably 30 minutes a day for a couple of months but this works this is going to get you the score that you need this is going to cause you to fail and we'll end up taking a lot longer because as we've seen before most students take months and months and months and months because they fail over and over and over again and the second reason is the students who fail are the ones that do things like i'm going to follow a general course or i'm going to learn some structures or read lots of band nine essays so why are you going to a general course when you are an individual you have individual strengths and weaknesses why are you going to a course that is teaching you about listening and reading when you've no problems with listening and reading learn some structures structures are important we teach our students structures but they are a tiny percentage of your overall mark and just relying on structures doesn't teach you anything about vocabulary which is 25 percent grammar which is 25 percent coherence and cohesion task achievement these things that actually matter doesn't teach you anything about those things or just reading lots of band nine essays i can't watch Ronaldo and Messi play football and then become a better footballer you can't read lots of band nine essays and then magically be able to write in the real test it's just not going to happen whereas our students what they would do is find out the exact reasons why i'm not at my required level yet and focus solely on those areas for most of you the reason why you are failing is just maybe a small handful of areas maybe three or four things that you need to work on and until you fix those things by getting feedback on your work and understanding what those things are nothing else is going to help you so getting the help that you need and getting the feedback on your writing on your speaking your reading your listening and then just like taking your car to a mechanic or going to a doctor when you feel ill they are going to fix the exact thing that's wrong with you not give you a general course the next thing that these students don't do or what they do is they rely on the wrong sources of information so they ask other students to help them with their work they look at youtube and they look for the cheapest teachers that they can find so other students would you go into a hospital and ask the sick people in the hospital to treat you no so why are you asking people who have got five point five six six point five to tell you whether your essay is a band eight or a band nine level that's just not going to work or going on to youtube look at the most popular youtube videos for isles they're teaching you tips and tricks and hacks things that you want to hear things that are popular but not things that actually get you the score that you need and finding the cheapest teacher that you can find trying by the cheapest house you can find or the cheapest car you can find or the cheapest pair of shoes that you can find is that going to be a good product or service you know that yourself what the answer is students who get the score that they need in the fastest possible time they're looking at the official marking criteria so we released a video recently where we were doing a mock speaking test with a student and people were criticizing the student based on things that they had heard from other students and seen on youtube channels and my response was always well where does it say anything about that in the official marking criteria that is what the examiners are using to assess your speaking to assess your writing so you need to know those inside out and a teacher with a long track record of helping people get high scores you should be asking your teachers you should be asking your schools what are your your past results like can we see some success stories if they give you a bad answer to that question then you shouldn't really go with them because again it's going to cause you to fail these students they rely on hope and luck i hope that i get the score next time that's not going to help you maybe i'll be lucky next time you won't whereas students who don't believe in hope and luck get the score that they need in the fastest possible time they get feedback on their work to understand what their strengths and weaknesses are and then they take action to turn those weaknesses into strengths to get to the score that they need and those are the students they get the score they need in the fastest possible time so again if you're trying tips and tricks and relying on unreliable information and hoping that you'll be lucky next time you're just going to fail over and over and over and over again and it's going to take you an incredibly long time whereas our students get the score that they need the next time they do the test because they prepare properly so by doing things properly you are accelerating your preparation time so just to summarize if you want to get the score that you need in the fastest possible time avoid shortcuts avoid tips and tricks and hacks and all of those things ask yourself what is my current level where am i right now what are the exact reasons why i'm at that level so if you're at 6.5 for writing instead of doing the test over and over and over and over again or trying some you know youtube video that teaches you the secrets to getting a band nine or some nonsense like that just show it to someone who knows what they're talking about and they will tell you the exact reasons why you're not getting a score that you need number three what do i need to do to move to the next level so if somebody tells you you need to work on a b and c work on a b and c a good teacher should be able to teach you that it is not that complicated it's really really simple once you know how number four make a plan of action get your calendar out or get it on on your ipad or whatever it is and just divide it into squares for each day and put the things that you need to do and do them and that's the point number five take action actually do the things people who rely on things like shortcuts and hope and luck the reason they fail is they take no action and number six do the test when you're ready don't book the test until you know you're ready to do the test you're not going to get lucky next time but many of you will be thinking right now but getting a good teacher is so expensive and i can't afford that i totally disagree with that and not because i'm a teacher not because i want your money not getting a teacher is truly expensive it is really really expensive let me convince you of that so this student let's say they spend fifty dollars on a really really cheap teacher or a cheap course and their test fee is like two hundred dollars and travel fees say they they spend about three hundred dollars each time they fail the test this is not unusual for someone to spend over a thousand dollars some students spend thousands and thousands of dollars failing the test over and over and over again so going for that you know scam youtube video or scam school or cheap teacher is costing you a huge amount of money whereas let's say this student instead of wasting all of this money they invested it in a good teacher or a good school and let's say they're down a thousand dollars but they end up going to canada or australia or america and they get a job like a fifty thousand dollars or something like that they are up forty nine thousand dollars that's the way you have to think about it because the people who are thinking this way and they don't understand the cost of free and the cost of cheap and the cost of believing in things that don't actually help them whereas our students they invest money our course is way below a thousand dollars by the way and then they get the score they need and they move to the country of their dreams get the job of their dreams and get the course or get the salary that they deserve so thank you very much for watching hope that you enjoyed that to help you out a little bit what I'd like to do is give you a free course it's our fundamentals course which will teach you the absolute essential principles of aisles writing speaking reading and listening it's totally free just click below to get that and you can get instant access if you need anything feel free to get in touch with us and my ipad is dropped so let's check if that has broken or not because that will cost me a lot of money thank you very much guys see you soon bye bye


The Lin Kuei is a centuries old clan dedicated to Earthrealm's defense. I will need your help. The fate of the realm may depend on it. I will emerge victorious. We settle for defending Earthrealm when we could help lead it. Whatever it takes, I am with you. We may not share blood, but we are brothers. And abandoned traditions sent you to learn our secrets. Brain will fall upon you like daggers from the sky. Lin Kuei's flame is not easy to smother.


I want to share what those are in this video here today. What's up guys? Alex Hine here over at Modern Health Monk. So before we jump into this video, I've put together a downloadable resource that will help, which is a free journaling worksheet. It's the first link right below this video, and it'll help you figure out how to get your life together, how to design the life you really want, not just in school, and what to do every single day to make that happen. So check it out. It's the first link right below the video there. Now the first thing that I would recommend is what I call prioritizing the anchor. It's like when you look at productivity advice, there's like, we imagine it as this pyramid. There are all these things you could be doing. And very often, if you're watching a video like this, you're looking for productivity hacks, right? You're looking for tactical advice. But in any field, whether it's becoming an Olympic athlete, whether it's becoming the best engineer, whether it's becoming some other icon, it's never the tactics that make you the best. It's the foundation. And the foundation really of productivity combined with mental health is health, right? Really the anchor is your health. And I would say the biggest thing is sleep, eating a whole foods-based diet, and exercising four days a week. So wherever you are on the spectrum right now of success to feeling well, whatever that ratio looks like for you, the foundation of mental health is always going to be actual health. So if you're sleeping six hours a night because you're trying to get top grades as a STEM student, you're betraying yourself by thinking that this bargain with the devil to sleep two less hours per night, hoping that the added productivity is worth it. I think you're probably delusional and that the diminished returns are going to add up very, very quickly. Or that, you know what, grabbing that In-N-Out burger really quick or that Popeye's chicken or the Chick-fil-A because it's easy, is better than that whole grains meal or the Mediterranean meal or sweetgrain, some salad shop. It's only going to work in the short run until it doesn't. So for me, prioritizing the anchor means you're getting close to eight hours of sleep. You're eating whole foods at every meal and you're regularly exercising for 45 minutes, four days a week. Those are the non-negotiables for health of any kind, especially mental health. Now the second thing that's really tactical is having what I call self and study blocks. This is how I got through doing a doctorate while also kind of maintaining my health and also building a really successful business at the same time. So it's a pretty high performance in all three. Of course I suffered in some ways, but I want to show the exercise that got me through. So this exercise basically involves taking out a sheet of paper and you're going to fold it up into a little square and you're going to divide one side of the paper into personal and the other side into school. So I'll show you. I get it to be about this small, all right? This is like a visual to do list, personal here. And then on the other side, we just do school. And then basically I would break it down into having three hours dedicated to school. So I would write down, for example, Biomed foundations and let's just say like test prep. These are my three tasks that I have to study or work on today. I would label them, you know, in priority. So then I would know what to do for that day. And from there, as soon as I finished the Biomed, like I was in a cafe studying, I used kind of a visual method to check it off, which is just like an OCD checklist thing. And then Biomed is done for the day and it's done for the day in the checklist. So one side of the sheet would be my school to do's and the other would be the personal to do's. So on the personal to do's, it would say something like I knew at some point during the day, I would have to meal prep. I knew that today I would need to go to the gym. And then I knew that today I wanted to just hang out with friends, let's say, and that would just be for the sake of fun and de-stressing. There's no real to-do list here. It doesn't have to be one, two, three. I just know that at some point during the day, these are the things I need to do for my well-being. So every day I created this kind of functional to-do list where one part is school and then one part was personal. And basically this is like my playbook every day. This is how I lived for four years, knowing that if I just do both things any time during the day, I would do well in school and I would do well mentally and in terms of how I felt. So this became my Bible, this little shading exercise that I came up with during grad school.  So we talked about this core sort of ritual that I used to balance both by being crystal clear deliberate on what I have to do on both sides, right? Performance and wellness. But in terms of school, the number one metric I made sure I tracked was putting in three hours a day of studying. Three hours a day of work or studying, really, but it was mostly studying for grad school. Now there's a book that I love called The Slight Edge and the author talks about an exercise he told his little daughter when she went to college. He said, if you just put in XYZ hours per day, you can do whatever you want.  But if you put in those couple hours a day, you'll do fine. In retrospect, I found out that was the exact exercise I had for myself, which is to have a digestible metric. For me, three work blocks, each work block being 50 to 60 minutes. And if I did that, I knew I would be great. So trying to fit this in at any time during the day, as well as these, became the goal for the day, the mission. Now for me, this was very, very helpful, especially going into undergrad. I did a combined half pre-med and half environmental degree at Clemson University.  And I went from a high school that was competitive, but I didn't work that hard to getting destroyed. I mean, I got a 1.9 GPA my first semester in college because I was in a competitive major and wasn't used to studying three hours every single day when there was not a test. Now those next semesters, I got a 3.9, a 3.7 to a 3.9 from a 1.9. So I was completely unprepared, unknowing how much work had to actually get done. And when I shifted to the three hour a day ritual, every single day, seven days a week, I destroyed my classes going forward. And go figure, I wasn't actually working that much more on a daily basis or studying more, but I was making sure I was deliberate about hitting that benchmark every single day, rather than haphazardly or a couple of days a week, I was doing it every day and that's what made the difference. So I find that if you can juggle the anchor and this ritual of one part personal and one part achievement, you'll be in a rare error. Someone who both does well professionally and someone who doesn't end up with a nervous breakdown or health problems or just so severe depression that you're medicated by the time you finished school. Many students are, but that's been the ritual that has made the biggest difference for me. You guys can check out a similar ritual, that first link, which is a journaling exercise and a series of journaling emails that will help you do the same. And before you guys go, I have two other related videos on this topic right there.


Hi, I'm Zor. Welcome to Unisor Education. Today I would like to talk about how electrons are positioned within the atom. This lecture is part of the course called Physics for Teens, presented on Unisor.com. On this website, it's not the only course. There are other courses like for example Mass for Teens, which is prerequisite for this one. Physics without mathematics just cannot be studied at all in any good manner. Also, the site is completely free. There are no advertising, no financial strings attached. You don't even have to sign in if you don't want certain functionality which is related to signing in, like supervisory style of education. So, what else? Every lecture has a textual description. It's basically like a textbook. So, with every lecture you have notes, which is like a chapter of a textbook. All lectures obviously are kind of organized into a course, which means there are menus, there are submenus, etc. So, if you want to really study as a subject, physics as a subject, you just have to follow the menu and sequential order and it will be fine. If you found this particular lecture somewhere through a search engine or something like this on YouTube or wherever, I still suggest you to use the Unisor.com free website to access the educational material, because, as I was saying, it's organized into a course and there are certain other components like text and exams, for example, which are also part of this website. So, organized electrons within the atom. Now, first of all, this theory of how electrons are positioned within the atom is really complicated. The quantum theory, which was developed somewhere in the first half of the 20th century, brought a lot of information, actually, about this inner structure of the atom, especially electrons, their position. We can start from the planetary model of Rutherford and extended by Niels Bohr. That electrons are supposed to be on certain stationary orbits where they do not emit any electromagnetic oscillations and that's what makes them stable on the orbit. A slightly different, maybe, wording of this. Instead of the word orbit, it's preferable to use a determined shell. So, electrons, because it's a three-dimensional world, so orbit is kind of flat. So, to reflect this three-dimensional structure, we're using the term shell. And then, the further development, theoretical and experimental development of physics, especially the atoms physics, brought another concept, the concept of sub-shell. So, apparently, electrons which belong to a shell, they actually are slightly divided as far as, well, their radiuses are. So, it's still within the shell, but shell is kind of thick. It's not like a zero-thickness sphere. It really has certain widths, if you wish. And within that widths, you have sub-shells, also stationary, so that's what's important. Bohr was kind of right that there are stationary orbits, but it's not like one electron per orbit or something like this. No, electrons live in thick shells, which each shell divided into a certain number of sub-shells. Now, let me go further and again. There are certain theoretical formulations and they are related to quantum theories. And what's important is that physicists came up to a very kind of mathematically beautiful structure of the shells. There are theories and there are experiments which confirm it, so we basically take it as the truth as of right now. Okay, so what is this particular structure of the shell? Apparently, we have shells number one, which is the closest to the nucleus. Number two, number three, etc. So these are still the shells in the level of understanding how Bohr understood it. So this is the shell where a certain number of electrons live. And this is another shell a little bit higher from the nucleus, further from the nucleus and more energetic. And this is still higher and higher and higher. Now, okay, shells are fine. Now, the next step was, as I was saying, sub-shells. Now, apparently, and that's what actually physicists came up with, and again it looks mathematically quite beautiful, they're saying that shell number one contains only one sub-shell, number one. So this is shell, this is sub-shell. Shell number two contains two sub-shells. Number one and number two. Shell number three contains three sub-shells. Number one, number two, and number three, etc. Shell number n contains number one sub-shell. sub-shell number 2, number 2 sub-shell, number 3 sub-shell, et cetera, number N sub-shell. So the shell number N contains N sub-shells. So again, I can say, well, that's the result of theory and experiments which have been developed. I am not going to go into the details, number 1, because I myself do not really know all the details. It's really relatively complex theories which kind of was confirmed by experiments. Now, so sub-shells is a stationary orbit of a certain number of electrons. Now the question is how many electrons? Apparently, the sub-shell number of each shell has a fixed number of electrons, which depends on this number, a sub-shell number. So again, sub-shells have a certain number of electrons which depend only on the number of the sub-shell, not on the number of shell, which it belongs to, which means the first sub-shell of the nth shell is exactly the same number of electrons as the first sub-shell of the shell number 3 or the first sub-shell of the first number of the shell number 1. Now, the second sub-shell of any shell contains exactly the same number of electrons for each shell it belongs to. Now, what is that number of electrons? All right, if you have a sub-shell number m, then the number of electrons, maximum number of electrons, actually, it can hold is 4m minus 2. Again, the question is why? I should really mention the same thing. There are some theories, very advanced theories in quantum theory, which basically explain this in some way, and there are experiments which confirm it. Which means what? The shell number, sub-shell number 1 has two electrons, and here as well, and here as well, and here as well. Now, the second sub-shell, which is m is equal to 2, has 8 minus 2, that's 6 electrons, 6 electrons, in the shell number 2, in the shell number 3, and in any other shell it has 6 electrons. The third shell, which is 10, 10, 10, and the nth sub-shell has 2n, sorry, 4n, nth shell has 4n minus 2 electrons. It sounds like, you know, nice system, right? I mean, number of shells, number of sub-shells increasing as the shell number, as the shell is further and further, the number of sub-shells it has is increasing in exactly the same number. And the number of electrons is also increasing by 4, basically. 2, 6, 10, next one will be 14, 18, etc. So this is the number, maximum number of electrons, which the sub-shell can hold. So now the next thing, okay, how about number of electrons per shell? So this total, well, this total is 2, this total is 8, this total is 18, which by the way, again, corresponds to number of electrons, as far as, well, before people came up with the sub-shell concept, etc., they do observe experimentally that 2, 8, 18, next one, I don't remember, I think it's 30, was the actually number of electrons per shell. But now this is some kind of a theoretical foundation, why do we have these numbers? Now, what are these numbers? If this is the first shell number one, and this is a shell number two, this is a shell number three, I think you can really have some kind of a, we can observe this particular thing. Shell number square double gives you this number. Shell number three, square would be 9, double 18, and same thing further. Now, so it looks like, it looks like shell number n has 2n square electrons, which is some of these. Now, is it true or not? Well, let's prove. Here we have a little bit of mass. So what I would like to prove is sum of 4m minus 2, where m is changing from 1 to capital N is equal to 2n square. That's what I would like to prove. And again, for n is equal to 1, I have 1 square, which is 1 times 2, 2. So for n is equal to 1, that's true. And then we will do it by induction. Remember, mathematical induction. Let's assume that for certain number n, this is true. And now let's prove it for n plus 1 using our assumption for n is equal to 2. So let's talk about a sum from 1 to n plus 1. This, what is it equal to? Well, it's sum from m equals to 1 to n, and then the next number, right? So from sum from m is equal to 1 to n of 4m minus 2 plus. Now, instead of m, we should substitute this as n plus 1. So it would be 4n plus 1 minus 2. This is the last n plus first member of this sum, right? So these are first n members. And n plus first member is just instead of m, I substitute it as n plus 1. Okay? Okay. Well, let's check it out. We have assumed that the formula is correct for n. So I can replace this equal to 2n square plus 4n plus 4 minus 2, which is plus 2, equals to 2 times n square plus 2n plus 1, which is 2 times n plus 1 square, which is exactly the formula we need for n is equal to n plus 1. So this is the proof by induction that this particular formula is correct. So for nth shell, we have 2n square electrons. Okay, so basically that's all I wanted to talk about today about how electrons can be, in theory, distributed among the shell, shells and subshells. Now, these are, well, this is the maximum number, obviously. It's not necessarily completely filled up. Now, how the electrons are filling shells and subshells would be a subject of the next lecture. But in theory, you just have to understand that these are capacities of the subshells and shells. So the capacity of each subshell is, as I was saying, 4m minus 2, where m is the sequence number of the subshell. And the total number of electrons which a shell, the entire shell can hold is this, 2n square. Now, about how we call these subshells, shells and subshells. Well, shells we call by number. Number 1 shell, number 2, number 3, etc. Now, subshells, well, physicists have decided to, instead of numbers, numbers were reserved for the shells. They were using letters. And in the beginning, the first subshells, which were actually discovered, they called with certain names. And the first letter from that name was used as the name of the subshell. So I don't remember the names themselves, but the first is s, for some reason, whatever it is. And then there are some other letters. I believe it's P, G, maybe F, something like this. After that, they decided, okay, we cannot really name them and use the first letter of the name. We'll just continue alphabetically. So after F, subshell, next was J, H, I, etc., so all along the Latin alphabet. So these are the first couple of letters. And then the next one are alphabetical. These are the subshell names, which physicists are using instead of I was using the subshell number 1, number 2, number 3. Now, why did they use the numbers to get to this formula? For M minus 2. Number of electrons that subshell number M can hold. So the first subshell would be 2, the next one would be 6, etc., etc. So, but you really should not use the subshell number. If you will read the textbook or something, you will see these letters instead of number. But basically, this is number 1, subshell number 1, this is subshell number 2, subshell number 3, number 4. I'm not sure actually the sequence might actually mix it up, but doesn't really matter. I mean, my purpose was to introduce you to a concept, a concept of a subshell. So that's what's important. So the shell contains certain number of subshells, named or numbered, doesn't really matter. And the subshells have this particular formula to give the maximum number of electrons, from which we can come up with this formula as total number of electrons per shell. Okay, so that's it for today. You probably have to read the notes for this lecture. I recommend you to read it on Unisor.com. You go to part called Atoms, and then you will have the next menu, and you will see the electronic structure of the atom, which contains this lecture. That's it. Thank you very much and good luck.