Salvation is a gift. Do you believe that works done on earth, determining a level of reward or responsibility in the kingdom? Yeah, I do. I think that works have nothing to do with kingdom residents. Okay, salvation. But scripture does suggest rewards in the kingdom, you know, are not all the same. I mean, not everybody has the same reward, that kind of thing. You know, 1 Corinthians 3, 10 to 15, I think suggests this. I'll just read the passage. Paul says, beginning in verse 10, according to the grace of God given to me like a skilled master builder, I laid a foundation and someone else is building upon it. Let each one take care how he builds upon it, for no one can lay a foundation other than that which is laid, which is Jesus Christ. Now, if anyone builds on the foundation, and the foundation is salvation, or that's Christ, if anyone builds on the foundation with gold, silver, precious stones, wood, hay, straw, each one's work will become manifest for the day we'll disclose it because it will be revealed by fire. And the fire will test what sort of work each one has done. If the work that anyone has built on the foundation survives, he'll receive a reward. If anyone's work is burned up, he'll suffer loss, though he himself will be saved, but only as through fire. So the works here are not the foundation. The works are what goes on top of the foundation. The works do not replace or displace salvation through Christ. That's very clear in this passage. The works are something, again, put upon top in addition to this status that was gained for us by what someone else did, namely Jesus. So the real question here is it an all or nothing idea? Some people will take this, and I've heard this preach, too, that if you're not, they wouldn't say it this way. But basically, if you're not nearly perfect, or as least as perfect as I am, the preacher, if you don't have a life of this endless string of victories here, spiritual victories, then you're going to get to heaven. If you don't have more spiritual victories than not, then everything's going to burn up in flames before your eyes, and you'll be with the Lord empty-handed. I think that's bunk. It's not an all or nothing idea. It's very doubtful. I doubt that it's a total loss because what that implies is that on the other side, you have a total success. There are no total successes in discipleship. Why? Because we're people. We're humans. We're fallible. We aren't deities. We're not God. We're not, by definition, we are imperfect. So if you're going to say that having failures, spiritual failures, and struggles with sin, sometimes you lose. You might even lose a lot. It might be a huge struggle that wipes everything out. I just don't see the coherence of that. Because then you're taking an imperfect scorecard. Let's say you have more victories than failures. Your scorecard is still imperfect. So God gives you everything.  If the scales tip the other way, it's a total loss. I don't think that's the picture at all. What I think's going on here, I should just go to a quick reference in 1 Corinthians 4, verse 5. Therefore do not pronounce judgment before the time before the Lord comes who will bring to light the things now hidden in darkness and will disclose the purposes of the heart. Then each one will receive his commendation from God. I think this verse needs to be part of preceding chapter, at least consideration in tandem with 1 Corinthians 3. I think what the point is that everyone is going to suffer some loss and everyone is going to get some reward. The tallies as it were, what that amounts to. I don't see any evidence in Scripture where it's equal for everybody. I think we're all just going to see how we could have been used, where we fell short, where we rebelled, where we stumbled, where we just failed. We'll see again what might have been what God could have done with us in a given circumstance. We'll suffer loss, but we'll also see what God was able to accomplish with us when we present ourselves as a useful tool. That's one of the motivations for holy living, to be useful. It has nothing to do with earning a place in God's family, mariting it enough. It has everything to do though with being useful. God wants to use people. He wants to use believers to help other people become believers, to help believers grow, to do things for the kingdom. You have to make yourself useful.  That's really where the rubber meets the road as far as the debate. Do we have Christians that are like 1% useful and 99% useless? Ultimately, I don't know. The Spirit of God takes up residence in someone and encourages them to prompts them to do certain things. Do they believe or not believe? Ultimately, I don't have the answer for that. Only the person knows that, and only God knows that at the end of the day. All I know is that we have to believe to have eternal life, and we need to be grateful. We should want to be useful. We need to be grateful for our salvation and live accordingly. Those are the clear things that are taught in Scripture. How we take that information and look at somebody else and wonder, well, that's a human thing to do. I understand that. Ultimately, we can't use those ideas to determine for someone else what's really going on there. I think we all know people like that. We need to talk to them and be honest with them about their sin. We need to challenge them to think about what's really going on inside. Are you really believing the gospel or not? I don't really care that you prayed a prayer 10 years ago, and now you've basically taken that and said, well, I said the incantation, I could do whatever I want now. I question that. I question the validity, the validity of your faith, because you've given me no choice. I wonder because you've given me reason to wonder, but I can't decide for you. I can't tell. I don't know, but you need to examine yourself. Isn't that a scriptural phrase? Let a man examine himself. I'm not going to examine you. I'm going to tell you that from what I see, it prompts a concern, but that's about all I can do. I can just tell you I'm concerned. I can't produce the answer for you. Only you can do that. We need to encourage people to examine themselves. That's what the New Testament does in any number of places. I think we ought to stick to that and not try to position ourselves as some sort of wise spiritual authority able to see behind the veil and penetrate a person's mind and really know what's going on in there, but we can get the person, hopefully, to consider themselves and then talk to them about the gospel. The answer is always the same, whether they are a believer and now they're just stuck in sin or whether they didn't believe at all. The answer is still the same. Do you believe this right now? Do you believe the gospel right now? I don't need a scorecard. I don't need a box score. I don't need to be omniscient. It doesn't matter. What matters is right now.


H39 coming in at 2 o'clock. So let's just take 10 minutes to talk about S40. And I would just like to go around the room and just hear, individually, from people what you're looking for. Why don't I start with you? I just feel that if this mandate should not be put on anyone except for, it should go to the general fund. One on each side. Risking of Edo. Risking of Edo. OK. I'm kind of on that same pony right there, but I don't want to put it into a fund that you can just raise proper tax to cover whatever they do in that case that's needed. Currently, this is all in the general fund. Right. Yeah. So I wouldn't want to do that. But you'd like to see 100% out of the general fund. I guess. OK. Rita. Yeah. I've just heard, like, in the last, this weekend, from two superintendents that I have tremendous amount of respect for saying, please fund this 100%. And these, I think these districts have money. These are just the county districts, so they have money. I can't even imagine what districts in the rural area, what kind of burden this could, what could fall on them. So I want 100%. OK. Yeah. I mean, if I could get exactly what I want, I would rewrite this bill to put testing on the schools because that is the fixed cost. And I think they can pay for it. And I would put all remediation in a grant program with these same numbers. And I think that we could put a lot more money into that grant program if we basically had a mandate to the state, to the local district. Given that that's not going to happen and that a get-the-let-out focus is not going to become what this bill is, I could agree to this bill if it funded at 100%, or if it capped the state's amount at 30%, and it's currently written, I don't support it. You would just say cap the locals amount of cash. Thank you for that clarification. I appreciate that. Dylan. I want to advance the bill that gets the let-out. I have to agree with Dylan, whatever is going to get it out of this community so we can get started. We're not going to know how much we need until we figure out what's the matter. I like the idea of 100% because it falls back on what the schools have to come up with and how would that affect our property taxes. I am on the 100% train, but I'm also sensitive to the urgency of our response to this problem. So I'll board whatever train will leave the station. Kathleen? I feel pretty strongly about 100%, but I'm not going to stop this bill. Whatever train is going to get the whatever we want to say? Whatever train will be we are going to board the train and get it out of the station. The fastest train out of here. I think that I go back to what Dylan said on Friday, about sort of the reality of things. Also sensitive to the fact that a year is going to go by.  And if there are financial realities to be faced then, they can be faced then. Yeah, I'm not married to 100%. I think it would be a good thing. But I'd like to see the bill advance. Trying to see if I can find a way to move it. But I don't think that we can do this forever. I think the longer that we're taking to get this bill out of here, you know, I just thought this was a Senate bill with them finding money. Did I say that? And the record was in the room? Take it back. I actually truly don't mean that. That's what he's thinking. So would vote against, OK, we've put it into words for me. All right, so it sounds like we're looking along. OK, first of all, I just walked in 20 minutes ago. Thank you, Seth. So we have our bill, and the question is moving it out of committee favorably or unfavorably. And the question will be, do we move it out of committee at 70-30 or do we move it out at 100? Who would like it to be 100? Like. Like, yeah, that would be our wish. That would be our wish. What's the chances of a veto? There was discussion this morning with the chair and myself and some of the people from the governor's office. I think the chances are slim, but available. And a little conversation at lunchtime with someone in the governor's office was, you know, really whatever way it goes, I don't think that the governor's going to veto. To me, I can't see that. He's right. Put the money in. The issue is what happens next year, the year after the year after the year after the year after the year after the year. So believe it that. We're putting pressure on the 2021 budget, not on the 2020 budget versus pressure on the 2021. The two positions, there's already 250 that we're hoping is going to be appearing in the 2021 budget. I am looking to see if I can get it to 100. I would like to get that sorted out today. And if I'm not, I'm going to bring the bill back to you at 7030 to vote on tomorrow morning, unless there's time this afternoon, but I don't think there is unless we want to come back at 6. Who would like, let me put it this way, who wants to vote the bill out right now at 7030? And who wants to wait until I'm able to see if I can find a pathway for the 100? Wait. OK, I was just going to say, I'm sorry. I can wait to see what you can find out. Who wants to wait to see what I can find out? OK. I'll see what I can do. I know we've worked really hard on this bill. And whatever I can get tomorrow, it's going to be the vote. It's going to be it. Because now we're holding it up. And the bill has two more stops to make just in the house. I just want to say, Kate, I really appreciate you trying. Thank you. Me too. Me too. Yeah. There's a point of fact that it should have been. Yeah, it should have been. Looking for the fast train, that train left quite some time to go. Why don't we take 10 minutes, and we'll go back to another easy topic. At 46. Yes, sir. It's already 9 AM. We are voting the bill. We're voting a bill out. I will let you know if I've got a pathway. Then the vote will be, do we go with the one in front of us? Or do we go with 100%? OK. And we will look at that. So 100 or it'll be 70. We do not have an appetite for anything else. Correct? Correct. Correct. OK. So my request is no surprises over the week, over the evening. That would go through your mind. That's our choice. 70, or 100, and it's out of here. Whatever it is, it gives me a pass and a vote. Yes. So now we have another vote. What's that? Oh, this problem. All right. So now we go on to something easy. Yes. H39. And is that from the Senate? It was already calendar today. I postponed action so we could speak today. Today we are going to hear from Nicole. We hear from the School Board Association, the Superintendents. We're going to hear from the Agency of Education. The question will be, do we concur? Do we concur with further proposal of amendment, or do we go to a committee of conference? Those are the three choices. Is anybody seeing a fourth choice that I'm missing? Postponing indefinitely. Postponing indefinitely. I am really hoping that we will not make that one of our choices. That's why. Postponing indefinitely. OK. So Nicole. So we had a presentation of the bill on Friday. Right. We do not have our attorney here today. You can ask him to come in or anything. Why don't you ask him if he can come up? Yeah. OK. Thank you, Nicole. Good afternoon. Good morning. My name is Nicole Mace. I'm the executive director of the Moscow Board Association. And it looks like I sent you the wrong testimony. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our vice president, Neil O'Dell, in the Senate Education Committee. And we did make a few changes, so I'll make sure you get that. Since then, the last time we testified in this committee on age 39, we did not have a position on delay. As we prepared to, for the record, my name is Nicole Mace. I'm the executive director of the Moscow Board Association. And it looks like I sent you the wrong testimony. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our vice president, Neil O'Dell, in the Senate Education Committee. And we did make a few changes, so I'll make sure you get that. Since then, the last time we testified in this committee on age 39, we did not have a position on delay. As we prepared to, for the record, my name is Nicole Mace. I'm the executive director of the Moscow Board Association. And it looks like I sent you the wrong testimony. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our vice president, Neil O'Dell, in the Senate Education Committee. And we did make a few changes, so I'll make sure you get that. Since then, the last time we testified in this committee on age 39, we did not have a position on delay. As we prepared to, for the record, my name is Nicole Mace. I'm the executive director of the Moscow Board Association. And it looks like I sent you the wrong testimony. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our vice president, Neil O'Dell, in the Senate Education Committee. And we did make a few changes, so I'll make sure you get that. Since then, the last time we testified in this committee on age 39, we did not have a position on delay. As we prepared to, for the record, my name is Nicole Mace. I'm the executive director of the Moscow Board Association. And it looks like I sent you the wrong testimony. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our vice president, Neil O'Dell, in the Senate Education Committee. And we did make a few changes, so I'll make sure you get that. Since then, the last time we testified in this committee on age 39, we did not have a position on delay. As we prepared to, for the record, my name is Nicole Mace. I'm the executive director of the Moscow Board Association. And it looks like I sent you the wrong testimony. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our vice president, Neil O'Dell, in the Senate Education Committee. We did make a few changes, so I'll make sure you get that. Since then, the last time we testified in this committee on age 39, we did not have a position on delay. As we prepared to, for the record, my name is Nicole Mace. I'm the executive director of the Moscow Board Association. And it looks like I sent you the wrong testimony. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our vice president, Neil O'Dell, in the Senate Education Committee. And we did make a few changes, so I'll make sure you get that. Since then, the last time we testified in this committee on age 39, we did not have a position on delay. As we prepared to, for the record, my name is Nicole Mace. I'm the executive director of the Moscow Board Association. And it looks like I sent you the wrong testimony. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our vice president, Neil O'Dell, in the Senate Education Committee. And we did make a few changes, so I'll make sure you get that. Since then, the last time we testified in this committee on age 39, we did not have a position on delay. As we prepared to, for the record, my name is Nicole Mace. I'm the executive director of the Moscow Board Association. And it looks like I sent you the wrong testimony. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our vice president, Neil O'Dell, in the Senate Education Committee. And we did make a few changes, so I'll make sure you get that. Since then, the last time we testified in this committee on age 39, we did not have a position on delay. As we prepared to, for the record, my name is Nicole Mace. I'm the executive director of the Moscow Board Association. And it looks like I sent you the wrong testimony. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our executive director of the Moscow Board Association. So I will send you the update in Virginia. OK, directed to the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our vice president, Neil O'Dell, in the Senate Education Committee. But essentially, the testimony on the record today is the same testimony that was offered by our board association. So I will send you the update in the House of Education. But essentially, the testimony that I have on the record today is the same testimony that was offered by our board association. So I will send you the update in the House of Education. But essentially, the testimony I have on the record today is the same testimony that was offered by our board association. but essentially the testimony that I have as the record today is the same testimony that was offered by our Political Board Association. But essentially the testimony that I have on the record today is the same testimony that was offered by our Lets School Board Association that That essentially, the testimony. The record today is the same testimony that was offered by our board Association. Send you. Essentially, the testimony that I have on the record today is the same testimony that was offered by our board Association. So I won't send you. but essentially the testimony that I have on the record today is the same testimony that was awkward via my tlb Association I will send you the but essentially the testimony on the record today is the same testimony that was awkward by our But essentially the testimony that I have on the record today is the same testimony that was offered by our Board Association, but essentially the testimony that I have on the record today is the same testimony that I have on the record today is the same testimony that ona education that essentially that testimony on the record today is the same testimony that I will send you. But essentially the test is a record today is the same testimony that. You that, essentially. But essentially the testimony that I have on the record today is the same testimony that I have on the record today is the same testimony that I have on the record today today's the same testimony of the Court of Od College Association, so I will send you the replied to как But essentially the testimony of the record today is the same testimony of the Court of Od college association. I will send you the that essentially the testimony that I have on the record today is the same testimony of the Court of Od College Association and the up of the But essentially, the testimony on the record today is the same testimony as the School Board Association, so I will send you the uppercut. の国会に加说した But essentially, the testimony on the record today is the same testimony as the School Board Association and the Teacher products Projected So I will send you the uppercut. The Lets Education But essentially, the testimony that I have on the record today is the same testimony as the School Board Association I will send you the 먹을board association. But is the but essentially the testimony that I have on the record today is the same ... I will send you... ... but essentially the testimony... ... on the record today is the same testimony... ... talk for the sotation... ... I will... ... send you... ... the case of a screening session... ... ... send you the... ...哎... ...잉There's little time to repeat it again... ... until the end of the 2021 summary.


Good morning, everyone. I think I'm going to get started just a touch early. So my name is Tim Mackey. I am a principal security strategist within the Cyber Research Center over at Synopsys, which is one of the three divisions of our company's goodness. And today, we're going to be talking about privacy, consent, trust, and security within modern application, modern application development. This is a shortened version of a talk that I gave at Black Hat a couple of weeks back. And this has been also tuned towards an open source scenario. The key takeaway that I would love everyone to have is that there's a lot that we can do as practitioners that will impact the overall security of the data that's being processed if we start thinking about what it means to collect and process data. And so I'm not a lawyer. I'm a techie guy. So my lawyers like me to say things like, please don't take everything that I have in here as legal advice because, well, 30 minute session, probably not a best idea. So I'm going to give a whole bunch of examples about things that we could be doing better and what the true implications are.  So in a three week period from May into June, we had a disclosure from a company called AMCA who was breached. They happened to be a credit processing company behind LabCorp and Quest Diagnostics, which would do lab work, blood work that your doctor might prescribe. We had records from the Customs and Border Protection people for faces that they had collected and information that they collected on travelers. And we had a whole bunch of information from a dating site that believed that encryption was really, really just a bunch of, well, if I hash it in XOR and we're good, right? So every year in July for the last eight or 10 years, IBM, in conjunction with the Poneman Institute, put out a report that says, here's what it actually cost for a data breach in the last year's data. So this is what 2018's data look like reported this year. The average cost of a breach went up from $4.2 million to $8.19 million. Customer turnover went up quite dramatically. But on the plus side, and this is a huge plus, for the first time in the last four years, we've actually gone down in the length of time it takes to identify and contain a breach. We're now only at 245 days, unless of course we're in health care, in which case we're at 412. And so all of this is framing the attack landscape that we effectively live within. And as we have more and more data and more and more data driven environment, regulators are kind of saying, but wait, hang on a minute, you guys have got it wrong. And so most people at this point in corporate application development have come across something called GDPR, which is a European regulation. And you may even see at our booth that we've got a little sign that says how we collect data, which is one of the requirements. Canada has their version called PIP EDA. Australia has the Notifiable Data Breaches Act. India is in the midst of trying to figure out what theirs would be. So there's a draft bill called Bill 21 2018, because well, it's 2018 that they came up with it. Now, while the preceding ones are very centered on what to do around data that is being managed, the Indian one has an additional provision around data sovereignty. And it basically says the authoritative data source for all Indian residents must be maintained in India. That's a bit of a change. California has the Consumer Protection Act, which nominally comes online in January of this year. But that has been delayed through a series of amendments to maybe June, maybe July. I'm still a little bit squishy. But because all of this data is really, really sensitive, and we see large organizations like your Googles and your Facebooks and your Twitters and so forth having access to all of this, it's not just the regulations that we have, but it's the actual what do we do next. And so yesterday, a group of state's attorney general decided that they're going to start probing in a little bit more serious way what actual data management is happening within big tech. And so they're going to take a look through, not necessarily the technical lens that we would all love them to look at, but they're going to take a look at it through, I'm a politician and I'm a lawyer, and that might not be exactly what we expect. So from an open source perspective, one of the interesting things that happened was the whole Equifax data breach, which was an attack vector through an unpatched instance of Apache struts brought a lot of focus on, well, what is open source? Who is the vendor of open source? Where did I get this from? Gee whiz, they don't seem to be doing security all that well, so maybe I need to go to a different vendor. Who can I go to a different vendor than this open source? And they asked a lot of questions that just didn't make a whole lot of sense, and in one part of our business, we actually deal with that kind of downstream. I like to be a student of other people's failures. I like to learn from them so I don't make the mistakes, and one of the things that I encourage everyone in this room to do is to read the Senate report on the Equifax breach. I refer to this lovingly as 72 pages of absolute awesomeness. This was about a two-year investigation, and it found, as you would expect, that the majority of the issues associated with the Equifax breach had absolutely nothing to do with the actual technology per se, but really were a people process breakdown. Off the top of my head, I believe it was 8,500 unpatched vulnerabilities within their software infrastructure. The person who, how CVE information was disseminated was a 400-person distribution list, where all new CVEs would just kind of go in at the top, and given the volume of CVEs that we see last year was a little over 17,000 new ones. If you're getting 17,000 emails from a distribution list, if you're anything like me, you've now built a mail rule that says I'm going to ignore most of that. Turns out that the owner of the system that actually was the breach vector wasn't on that 400-person mailing list, and when he asked the question, his boss said, no, you really don't want to be on that list, trust me, dude. And so there was a long period of time, and so one of the interesting things from an identification and remediation perspective is that it actually took Equifax less than 90 days to identify and contain the breach. So that 245 number, Equifax did way better than the average. Now, when we look at how data is managed, there are a few truisms, and rule number one is you can't possibly secure data, you don't know your processing. So that needs us to have a couple of definitions, and there are a few notes in here that there's legal nuances around this, so again, I don't play one on TV, I just read stuff. So one of the things that I actually get questioned about is why don't we have a version of GDPR in the US? Why do we have a patchwork of each state having their own version of what data protection really means? And I like to look at, we do have some national standards around this, healthcare information, anyone who's ever gone to a doctor, hospital, clinician, had blood drawn, you've got the litany of papers that say, here's what's going to happen, most people don't read them because, well, they wouldn't understand half of what was in there anyway, but it basically defines what data means, and here's their definition. Normal people tend to define data as any information about myself which is provided to somebody else in order to give me some kind of service, that's data, and within my development team, because we're from the Northeast, we modify things a little bit, and it's actually data, so if you hear me say that, that's where that's coming from. So from a data privacy perspective, we need a definition as well, and so ISO very nicely defines it in 2009, 2011 as a set of shared values governing the privacy protection, so when you're defining privacy, using the word privacy in your definition, so yeah. There is no common legal definition across the board. Using the Canadian example, it is not actually defined, but it has a set of protections around right to life, liberty, security of the person, and in the US we have similar things around some of the constitutional amendments that give us the beginnings of what privacy might look like, but they're not necessarily defined within a legal construct. Now, of course, if I'm a normal person, I say that that's an expectation that I have whatever data I just gave you is going to be properly protected. So what are you going to do about that? And so I'm going to give an example, and I can give the whole story behind this, but I'm just going to highlight the little yellow bits. So we've all gotten emails from somebody else that we didn't expect to have, and so I got one from Wells Fargo. The person opened an account and typoed the email address and it says, you requested an update to your email, this link will expire 90 days. So I ignored that, figured that there must be something behind it, whatever. Couple days later, I got, oh, wait a minute, you've added this person as a NewZell recipient, here's their phone number and they're now going to receive this, oh, okay, maybe I should try and do something. Then a day later, wait a minute, here are all these transactions. So wait a minute, I just sent out a whole bunch, I just received a whole bunch of information that was sent to me, assuming that that email address was legit. Try calling them and explaining the situation and seeing if they can resolve it. That's a fun conversation. Another variation on this. So Plum Benefits is a company that does benefits management for smaller organizations. In this instance, one of the people decided that they were going to book a hotel. In Baltimore, by the airport, on these dates, here's their name. So what do I have here that I can use to go and impersonate them? What do I now know about them that could facilitate a different type of attack? This was a one-off, turns out that it was legit. They were surprised that I received it. Try having that conversation that I didn't just just my email address. True as a number two, if your users don't know what you're doing with their data, you increase the reputational risk to your organization if something goes wrong. And this gets us to consent. And consent is a hugely tricky construct. GDPR defines it as all of that and I'm not gonna read it for you. All the slides are up on the thing or actually I think I need to put an update and I did a couple of tweaks in here. But it basically boils down to, before I consent to anything, I need to know what you're doing with my data. Who you're gonna share it with? How long it's gonna be around?  So just because I consented right now doesn't mean that it's going to be in perpetuity. Similarly, trust is a really complicated concept and there's no legal framework around this. I went back and forth with our internal attorneys around what we could call this from a legal perspective, couldn't come up with anything. So the PR agency defines it as reputational risk as the risk of loss associated from damage to an organization's reputation. The AMA defines it as, from a consumer perspective, brand equity is based on consumer attitudes about positive brand attributes and favorable consequences of brand use. Would you trust a brand that just leaked 100 million, a billion records? They're in the news every day. People are growing numb to these things. Common definition? I don't just trust my data to everyone. If the provider is one whose brand I trust or one that solves a real problem for me, I'm more likely. So it's not an absolute to give them data. But again, I reserve the right to change my mind. So in the black hat version of this, it was the top 10, but we're open sourcey so I can go a little bit more detailed in here. So top 10 questions. Does the person who you're collecting the data from and from an open source perspective, this is huge because the components could be used anywhere in any context. Is there clarity around why the data is being collected? If it's being sent to a third party, is the user clear on who that might be? Because if they get breached, I need a way to know that I should be maybe doing something different. Is there an opt-in or opt-out context around this? Under GDPR, opt-out isn't consent, opt-in is. Who internally could have access to the data? Maybe I'm logging every attribute that comes in. Well that was kind of the movie pass example from yesterday where there's a whole bunch of splunk data that was up in an unsecured S3 bucket and then includes all of your card data. Oops. Does it require any specialized processing? Encryption hashes. In New York State, there's a draft bill called the SHIELD Act and in the SHIELD Act it says that all sensitive data must be encrypted. Doesn't specify how or what sensitive might be. So I figure MD4 is probably good enough. How would you know if somebody accessed the data in the first place? Have you informed the consumer how long you're going to have it for? I can't remember the name of the organization now but three weeks ago there was an organization that had phone records from customer support agents that go back to 2015. Why? Oh, for the purposes of training. The person on the call probably isn't an employee there anymore because they're in a call center. What's the purpose? If regulations allow the user to delete or correct the data, what's the process? How would the user know? What data is being transferred as part of a phone home mechanism? We love phone home mechanisms in tech these days. Do people know that that's happening? If a web service is used, how is that transmitted data handled? Where does it go downstream? These are really, really key questions that everyone can be asking for every piece of software that we're developing. So GDPR had a reputation of, well, we're just gonna solve data breach problems. But in January, Google found out that it's not quite so simple. So the onboarding experience for a new Android device was brought to the French regulator CNIL because it included a perceived obligation to go and have a Google account.  Google found much to its great dismay that despite having a European presence in Ireland, no data processing decisions and data security decisions were actually occurring in that location. So French regulators had jurisdiction. French regulators annoyingly prefer to do things in French. And when you're an American company, French law doesn't always necessarily make the same amount of sense as you would expect. So Google complained. But in the end, Google now assigned what's known as a data protection officer to be part of the Dublin operations for Google. And there was an entire reorganization in December around how those operations were going to be occurring. Fast forward to two weeks ago and German regulators in Hamburg decided that it would be a fantastically brilliant idea to say, well, let's invoke article 66 of GDPR which says that there's an egregious issue going on and we need to stop this now, the moral equivalent of an injunction. And they were upset about Google assistance that were having some aspect of the data being processed by humans. But that was never disclosed.  As it turns out, Apple was doing the same, they shut it down, Amazon was doing the same, they shut it down, or at least they've deferred it. It's a 90 day period where they gotta figure out what the right answer is. But change in application and product behavior. And that could have a serious implication to what the future might look like for data. So when a data incident occurs, the only data that can ever possibly be exfiltrated, which is sent out and stolen, is the data you retained in the first place. So if you don't have a need for the data, say there's no regulatory requirement to keep it for longer than a couple of days, couple of weeks, why are you keeping it? That's just an open invitation to something getting out there that shouldn't. And that can have serious reputational implications when, say, the company you're working for happens to get bought. As Marriott found out after acquiring Starwood and finding out that there was a whole lot of passport data that had been being breached for a multi-year period starting in 2014. And so you can have goodwill impairments, SEC filing requirements. You could have churn of customers, a whole lot of Marriott customers who said, yeah, you know what, no, thank you, I'm going someplace else. Potential for bankruptcy reorganization, AMCA, the company that was behind the Quest Diagnostics breach, they lost 90% of their customer's revenue in a span of about a week, and they filed for Chapter 13 bankruptcy protection. They have two customers left. And they're trying to figure out what this actually means. Obviously regulatory finds potential for impact on the supply chain and increased cost of customer acquisition. Do I really want to trust this brand? What does it mean to reacquire? And we see that throughout brand management, independent of cybersecurity issues. Number four, as applications evolve, original decisions around data collection become opaque. So the moral equivalent of this is, woohoo, I've got data. What can I do with this data? So as long as I've got that, I'm going to find a good way to do something interesting with it. And it's probably not something that the people who gave it to you originally thought about. So that gets us to the idea of anonymizing data. So in July, Imperial College of London put out a report where they were able to take some anonymized data sets and basically say, yeah, you know what? This person who suffers from this illness who happens to be receiving care and drives to this location in a Vauxhall Astra, well, their name is because they could marry all of this data together and figure out who drove a Vauxhall Astra and lived in this location. Couple days ago in Australia, the Office of Victorian Information Commissioner looked at a few million records that were released under the MyKey travel information. So this is a smart card that is used to go and get into trams and buses and so forth. And the commissioner had released anonymized information for this which said, I'm not going to include the card number, I'm gonna put a UUID behind it and I'm now going to be able to connect the dots and say, well, this person got on here and got off there. And so now, well, what's the average duration? Lots of research value to this type of information. Up until the point where they said, you know, it looks like these people are always getting on here and getting off there and it looks like on the way home they do this. So isn't that the minister of something? In the Australian government, aren't these people, we don't know if with 100% certainty, but. And so this is what can happen when you have anonymized data that gets married with other publicly accessible information, like say an overlay on a Google map and suddenly you can pin things and say, well, what's going on? And so when releasing data sets, which personally I'm in favor of any kind of research that we can do on this, we need to be very, very cognizant of the fact that the data is going to be married to something else eventually. Maybe not today, maybe not next week, but eventually. Number five, given access to data, people will find a way to use it and potentially misuse it. Lots of examples of this, but the real challenge is that today an application is really a mashup of things. And so web services APIs really change stuff.  Behind that was a company called 24-7-IO, 24-7-IO was breached a year and a half ago. I had never heard of them up until that point, but I got a nice little letter from Delta saying, I'm sorry, but your credit card appears to have been used as part of the, it's like what? And so the supply chain of web services becomes a real interesting scenario. And so you have to ask these kinds of hard questions. And managing consent can be really complicated. So you've got voice assistants. I set up my voice assistant. I give consent. My girlfriend's in the room. What was her consent to potentially being recorded if the thing is always on? If there's a software update and I perform the update, but my colleague originally gave consent, is that a legitimate scenario? I thought I'm on a mobile device and I have a jurisdiction associated with consent. Is my jurisdiction where my mobile device was accessing legit? What if I'm over Wi-Fi versus 4G or 5G? What if I change my mind? How do I identify myself in a way that will allow for me to find out what you've got? So if I'm an innocent third party and there's an Alexa on the table, how do I identify myself to Google to say, I want to have all data associated with me? These are hard problems that we still haven't solved today, which is why we need to understand when we're collecting data, why we're collecting it, and make certain we don't have it for any longer than we need to. So I'm gonna show how this could evolve in a very simple scenario. I want to design a nice new shiny IoT device because that's kinda all the rage. That statement has a lot of implications. So I have an IoT device, hunk of hardware, gonna be bolted to the wall, needs to be cheap, do exactly what I wanna do, and did I mention cheap? So I'm gonna choose whatever I can do to get the costs on that down. Now that has to be configured, so I'm probably gonna have a mobile device, I'm gonna scan a QR, and I'm going to have a Bluetooth low energy connection to it, and it's now going to inherit my Wi-Fi connection. That device is probably going to need to communicate with some centralized service, so maybe there's a TLS stack, maybe there's a protocol on it. So now I've got some constraints around this device. Maybe there's a TLS stack, there's definitely a Wi-Fi stack, there's a Bluetooth stack, there's TCP involved. That's a lot of overhead, if you've ever looked at those protocols for this little cheap device to handle. What are the concessions that are gonna happen? Okay, so I've got my MQT broker, MQT broker in this example, I've got my analysis engine, I've got a database, I've got, well, I'm probably gonna microservice containerize the thing as best I can. I wanna have a web UI, I've got some HTML5, probably gonna do this all up in Node or React, and obviously I've got a mobile interface down. And all of these things that are up in the cloud, well, I can update them in a DevOps-y way very easily, but my IoT device needs some mechanism, so I'm gonna have an over-the-air. So I've now put all of these constraints on the system that have design implications, security implications, and privacy implications. So from the outset, I need to make certain that I'm setting the platform requirements. And from a design goal, that means selecting a tool chain that is going to be the best for this particular device. I may have different CPUs, different memory configurations, different interface chips that I can use. This is the perfect time to build one of each.  Because that room for my application is gonna allow me to manage the privacy of what's in there better, because that device instability could be an entry point. We've seen examples after examples of devices that were unstable and that instability that becomes the ultimate attack vector into some organization, home or business. Similarly, the development frameworks are going to have a role to play in this because a lot of architectures where I've got very distributed processing, that's going to mean some level of data transfer. So how am I securing the data in flight? How am I securing it at the other end? If I've gone to a cloud-based service, how much of the ownership of the infrastructure that I'm transferring to that cloud-based service is actually going to be something I need to worry about from a regulatory perspective? Like if I'm taking credit card information, is the underlying infrastructure something that can handle credit card information under PCI guidelines? These are the kinds of questions to be asking at the architecture side of the decision-making process. Obviously, as I'm doing my development, I want to make certain that I have continuous assessments that are happening because if my developers don't have the right level of security training, they're probably also not going to have the right level of data management training to ask the right questions. So what can we do to up-level the skill set within the development teams themselves so they can start to ask those hard questions and be part of the solution? Similarly, when we're building all of this, I'm going to assume everybody's using some form of CI at this point in time, what is the test coverage? Can I actually identify what the data flow is within the application to a degree where I can say, this was encrypted form at this point, but everything before here, this is now tainted and unavailable data to me and have some form of centralized process where I can go and say, how good are we getting? We all know that version one is probably not as secure as we would want it to be, but as long as we're capturing what version 1.1, 1.2, and so forth looks like I'm moving towards the right direction, we're baking it in from the outset, not necessarily trying to bolt it on later. We're asking the hard questions when they're inexpensive to be asked at the outset. And then lastly, as we release this, and personally from my perspective, everything before the time that we actually released software is an academic exercise. It really doesn't matter how secure or insecure things are up until the point that we ship it. So we need to make certain that at the point we ship it, we understand what the governance rules are wherever this device is going to be shipped because there might be a period of time where say six months of development needs to happen before that V1 of our nice shiny IoT device can be out in the world and somebody might have come up with a new regulation and now we have to kind of go and ask ourselves some hard questions. And so that pretty much gets me to very key takeaways for this. From an open source perspective, I wanna look at the contributor side of the equation. We want to ensure that everyone who's contributing code that touches data in any project is able to question why that data was collected in the first place, why that data is part of that workflow and be able to communicate that out because that component is going to end up in some place you didn't expect it to be. And I can say with all honesty, and it will live for a lot longer than you expected to live. One part of our business actually goes and looks at commercial software. We found a vulnerability in a version of FreeBSD before FreeBSD was a thing. And it was still in production last year, 18. So we wanna make certain reviewers can identify what sensitive data is involved and where things are going. We wanna make certain that we're disclosing in whatever our readme doc, pubs, wiki, our expectations around data processing and data collection are. And we need to move away from self-documenting code because the people who are going to make those kinds of determinations are not the people who are going to be able to read the code. And if we assume that, it's kind of game over from that point. We need to make certain that governments is a cooperative action between project leadership and the development teams. No more merging looks good to me if there's data involved or plus one. Ask the questions. What tests were performed? Do you know whether or not this is going to be encrypted correctly? Is the default plain text or is the default something that is securely hashed by today's standards? Oh, we need to change our hashing rules or our encryption rules. Why are we making these changes? Are we ensuring that we're actually using a library or not rolling our own? We can't assume that the component is, say, only going to live in the US because in the US is a patchwork of regulations. We can't assume that the component is only going to live in Europe because there's still a patchwork of regulations. One of our customers in financial services described it best. His application has to adhere to 378 separate global regulations. How can we make certain that our open source components that we're contributing to and we love can actually satisfy that kind of environment? Those are the types of hard questions that we should be asking in documenting all of these decisions so that when somebody in, say, a highly regulated financial services world decides to consume something, they can at least know that, well, you thought about these problems. They might not agree with your assessment, but you thought about the problem beforehand and now a conversation can happen. And by definition, we're going to have legacy stuff out there. And so we need to have some process where the project defines a policy around how it's going to manage data governance. So we all have contributing.md. We need to have some variation on that that talks about data collection and data processing. We need to make certain that we're reviewing our default configurations because the version 1.0 default configuration might be insecure by today's standards and it might be a simple case of tweaking those defaults to make it a lot better knowing that somebody is probably going to trip over version 1.0 and say, woohoo, that's awesome. I really want that version, not realizing that there is in fact version two. And fundamentally start thinking about the software life cycle. In commercial software, we'll have, this is an alpha, this is a beta, this is a release candidate, we're released some lifespan, some updates, oh, wait a minute, we're going to end of sale, we're going to end of maintenance, we're going to end of life. And there's a lot of documentation that goes around this that customers know about these things. But if it's an open source project, most of the time it just gets abandoned on GitHub. And you see, oh, wait a minute, there hasn't been any update in three years. Is that because it works and there's not really anything more to do with it? Or is it because the person who was originally maintaining it decided that it was something else cool to do and they went off and did that or life happened and now they're playing with their kids instead or something. And there's no way of knowing this so that when you decide that, you know what, I'm done with this, update the read me if nothing else to say, you know what, I'm done with this. This is the last version. If you fork this, it's kind of on you to go and do stuff, but I am done with this. And at that point, you don't necessarily have a whole bunch of issues where people are saying, why haven't you processed my pull request?  And you don't have those kinds of scenarios. And so that's it for my talk. I've got a whole bunch of references for all of those lovely regulations up there. I thank everyone. I think we have about two minutes for questions if there's any questions. Yes. So I think it would be unfair to say that we have a solution per se as much as this is a paradigm that we should all be working towards. And so if we're looking at it from we're consuming those types of devices, there's not a whole lot that we can do short of starting to question the providers of those services or the manufacturers of those devices and say, what do you have on me? How are you collecting it? What have you done with it? Give me all of the details. Regulations like GDPR have that obligation associated with them. Not all regulations do. And even under GDPR, there's no standardized process. And there's no standardized return form for the data. So you don't necessarily have 100% confidence that what you get back is gonna be something that is in fact usable to you. Or maybe for us in the room it might be more usable but usable to the lay person. So excellent question though. Any others? Yes. So I have a couple theories and one of the simplest is in a healthcare environment, the longer time is fundamentally a realization that doctors aren't tech people. And as long as it's kinda working, they're good enough because they much rather go and fix your leg or whatever else is ailing you than worry about patching things. I think that that is fundamentally what it is. And now you effectively have an attack scenario where the malicious actors know that there's a lot of value in healthcare information and the ability to secure it is not as strong at the local level. So hopefully we can do better but it's through talks like this that shining a little bit of a light and having people start asking the questions is really good. So I believe I'm done for time. So thank you ever so much for everyone.


YouTube team keep it clean. What's going on? It's engraving here with another video and in this video Beautiful way to end that first half now real quick We got to get right into this cuz you know, we're not gonna have enough time We got so much that we want to talk about obviously so make sure y'all subscribe Subscribe if you haven't already if you're new here Make sure you leave a like on a video follow on Twitter follow on Twitter the Twitter's engraving vids so Lamar Jackson obviously starting in this game How did they start off they started off with a heavy heavy heavy dose of the run game heavy dose of the run game Super heavy, but then and they move right down the field they move right down the field with the run game Lamar breaking left and right running running running running running and It was nice, but The thing that I was about to say the dingles the bingles they adjusted The bingles adjusted they adjusted to that. So they made the Ravens.  No, it was his second throw where it was a sack It was a sack and I tweeted out had that been flack. Oh, that was a sack But it was a sack on that play. It was a sack. He got sack, but no, he said wait there's more to the play he broke out of that and He escaped and still got a chance to throw the ball off Thank goodness it got it did get picked off cuz we would have been hoping that it was a sack in that case but um Yeah, he he broken it. He still got a chance to extend that play and that That's what a lot of us have been talking about That's what a lot of us have been talking about the people that that don't want that still don't want to give Lamar Jackson a chance This is what we've been talking about with Lamar Jackson. What he can do that flacco can't he can extend those plays Flacco can extend plays too, but to a certain extent, but he can't extend them like Lamar can Has flacco escaped before? Yeah, of course, of course, but He can't escape and extend plays like Lamar can because their legs ain't built the same That is just a big difference that a lot of us have been talking about we've been talking about that That's one of the biggest reasons that we wanted Lamar to start cuz offenses are faster but defenses are faster too and Not saying that oh just because somebody's a pocket Quarterbacker just cuz somebody's not as mobile as somebody else that they won't be as good but still Lamar can extend those plays he can extend them and you saw it look look at the play right before halftime I thought I was setting up this video. I was set. I'm I'm tell you no lie Well, I'm a lot of y'all anyway, but I was setting up this video. I was getting ready to glide and I was like, okay, it's 22 seconds left. Yeah, the ratings about it's about to be 10-7 So, you know how I put the score in the title of my video So I put Ravens 10-7 and I was getting ready to set up set up the thumbnail Whatever and and get ready to go live, but then I didn't put it yet though. I said like, you know what? Let me wait. Let me wait The Ravens They get Lamar Jackson. He drops back and again extending the play extending the play extending the play extending the play That's what it is. That's one of the biggest things that he can do Extend the plays and he completed the pass to a wide-open John Brown Have that play not been extended Who knows if John Brown would have been open or not because sometimes as we know as rave as Ravens fans We know sometimes it takes Sometimes it takes longer for receivers to get open and then aren't than others But that's fine. But that's what that's a big element that Lamar brings he extends those plays Jeez man Killer said he won flackle back. Hey, that's fine. Everybody's entitled to their own opinion Mine's a little different from yours on flack. I've been waiting for this Yeah, what a hundred thirty one yard Russian yards in the first half shout out to Lamar shout out to Gusta bus shout out to Alex Collins That's that's probably that's probably the most Russian yards we've had even in a whole game since I'm even remember when We got a hundred Russian yards in the first half. That's unheard of with the Ravens. That's unheard of That's unheard of that's what kind of weird stuff is that over a hundred yards in the first half. That's crazy Yeah, but I'm glad Gus Gus the bus is getting a chance Because he hadn't really got much of a chance after that fumble that um Who are we playing? Was it the Steelers game? I think it might have been a Steelers game But whatever game it was he hadn't really got much of a chance. He hadn't got much of a chance He said why trade for time not even use them We'll see how the second half goes man. I but you know who we didn't see at all I didn't see 37 out there. Did y'all if I if he was out there. I sure missed him Maybe I need to go get my prescription fix on my glasses, but I sure didn't see 37 out there I didn't see Buck Allen at all So oh thanks for bringing up RG3 remember what I told y'all in a video yesterday Remember what I told y'all in a stream earlier today about RG3 So watch RG3 actually be a weapon on those plays The plays where they have RG3 and Lamar there together. I said watch him actually make himself a weapon Watch him do that and he did it. He did it RG3 Back up backup quarterback Not backup quarterback backup backup quarterback.  Oh, yeah, back up back up. Love it Love it. Um now Lamar with the deepest pass he completed was the John Brown throw But I like how they they are getting him in a rhythm. He's completing some short passes He's throwing it not too tight of windows, but he's making some nice passes He ain't doing anything crazy yet in the passing game, but he he's met. He's he's he's doing this thing He's doing this thing The only two incompletions he had were the one that all One that almost got picked off where it was almost a second It was almost a pick but thank goodness both of those two things were avoided and then the second one Where he just he just it almost looked like he he he threw it out of bounds And I don't know if he did it on purpose or not But wait through it to Crabtree, but it was a deep pass downfield and And that was it those only two incompletions that he got Mother than that. He's been he's been making his making the passes and they've been short They've been like eight nine yards stuff like that, but that's what you got to do You got to get him in the rhythm get him in the rhythm get him in the rhythm. So I love it Oh three incompletions. Okay. Whoa, okay Well, that's a record Yeah, man, so that ain't bad man. That ain't bad. I'll take that I Take that but yeah what I want to see in the second half I want to see I want to see them continue to run I do not want to see them forget about the run game, but I want to see them open it up Open up the passing game for oh open up the passing game for him because he We're ready for it man. He's ready for it. We ready for it. It's time. It's time So because that order and we left a lot of points on the field or not a lot But we left we definitely left a touchdown because you you just know when it was it was third and one I think it was yeah It was third and one from like the three or four yard line Then they called the holding penalty on our Patrick record. I think you know, we were getting into the end zone man You know you're getting into the end zone because they had just ran into Gus Edwards And he got like to the two yard line You know, we were getting into the end zone, but then that played back this up and then we ain't get Oh, man, these penalties man the penalties penalties is killing this game killing it We um the the push-off by take the push-off on Tay-Tay like man. Yeah, what they called that But then they they were because Marlon Humphrey should have been called for deep for illegal contact or defensive holding a little later on in the game, but he wasn't What else Just the holding penalties the false there was only one false start and that was by Nick Boyle But Nick Boyle that has been making up for it because he made some nice catches Oh CJ Mosey because a couple people had tweeted me about CJ Mosey I said I haven't really seen him get attacked in the middle yet So I'm holding off but he has been so far so good and he made one tackle where he picked up and slam the guy But we always said he's been a good tackler. He's been a good tackler So the linebackers have been doing that thing even though Kenny young he messed up on a on that screen pass That got the bingos. I think a 21-yard play Kenny young messed up on that one But the linebackers have been doing the thing the secondary for the most part Yeah, the second they've been playing pretty good man They've been playing pretty good They really give up the only big play they gave up was the Tyler Boyle one But I'm but that was the push-off that's why he pushed off Marlon Humphrey, but it's all good It happens the CJ Mosey almost some almost. Oh, oh take take got away with one early Okay, I don't remember that all the Andrews penalty the push. I mean not to push off the offensive pass interference That one I thought it was a good call because I thought it looks so obvious I'm like man. I'm like come on like at least try to hide it I felt like he made it look so obvious and I know a lot of people were mad at the call I wasn't mad at it I was more mad at Mark Andrews cuz I'm like man You couldn't even like you could have just like ran into the guy you this dude went Like come on man, come on Don't oh, yeah, yeah was tape on he pushed off of yeah my fault, but um, yeah the mark Andrews He just went ran into the guy He just charged him He just charged him. He charged him. I'm like come on there. Jimmy is all bad. No, Jimmy He got caught on like once but no man But yeah, we keep on what we've been talking about all season to Ravens have been getting this close But they don't finish they've been getting this close this close This close with the um The Zidarius Smith almost got it CJ Mosey almost got the pick And that was the only two the Tony Jefferson was not almost because that was a false thought I saw that one and I was like why I was surprised that they called it because I saw it on the TV and I yelled out false thought But the play kept going and then they oh Okay, my whistle ain't working right now, but they blew the whistle.  It was just it was like he's not a professional He made it this far cuz he is a professional. So let him do his thing. So we we excited for the second half Can't wait for the second half This should be fun man. Oh pass rush pass rush pass rush been We got to Annie done a couple time pass rush been okay.  Anyway, appreciate y'all love y'all. I can't wait to see y'all after the game We got 300 people in here. Let's get six seven hundred in here after the game. Love y'all We out man