Hi and how are you all today? Let us discuss this question, it says write the general term in the expansion of x square minus y the whole raised to the power 6. Now we must know first of all how do we write the general term of r plus one-eth term that is ncr e raised to the power n minus r v raised to the power r. Now the knowledge of this general term is the key idea of a question the solution says the general term of tr plus one is written as ncr a raised to the power n minus r v raised to the power r and we are given x square minus y raised to the power 6. First of all we can write it as x square plus minus y the whole raised to the power 6 right. Now here on comparing it with the general term that we explained in the key idea a is equal to x square b is equal to minus y and n is equal to 6. On substituting the values of abn in the formula that is mentioned in the key idea we have tr plus one is equal to 6cr a that is x square n minus r b that is minus y raised to the power r that is it can be written as minus one raised to the power r 6cr multiplied by x raised to the power. Now this two has been multiplied with 6 and then with r and can be written as 12 minus 2r getting multiplied by y raised to the power r. So this becomes the answer of the section. I hope you understood the question do remember the general term of the binomial expansion as it will be useful if on many of your solutions. Take care.


Hello and welcome to this video session on medium access control protocol aloha. So as Mac is one sub layer of the data link layer and one of the function of data link layer is the access control. So in this video we will try to understand how we can have access control for a shared channel. These are the learning outcomes of this video. At the end student will be able to identify the problem with the shared channel that is channel allocation problem and then solution for that may be static or dynamic channel allocation. So student will be able to differentiate between what are the advantages of static or dynamic channel allocation schemes and at the end we will see aloha protocol for channel allocation and we will compare the performance of two aloha protocols pure aloha and slotted aloha. So these are the contents of this presentation. So let us try to understand what is channel allocation problem. How we can determine that who will get access to a shared channel when there is a competition for it? In this network diagram you find that there are different nodes named A, B, C, D, E but you find that they are sharing a common channel. Now when A wants to have access of this shared channel, A wants to communicate with D let us say at the same time suppose B wants to communicate with E what happens in that case will be if you are directly simultaneously sending the data on to the shared channel A is sending data to D as well B is sending data to E at a time on to the same shared channel two different nodes are transmitting the data. This will result into invalid frames. The reason for generation of these invalid frames is called as collision. The reason for the collision is the invalid frames are called because other stations transmitted at the same time when one station was doing the transmission of the data. So collision happens and when collision happens you have to discard that particular frame. So this is the problem where a shared channel if is used by more than one nodes and simultaneously they are trying to send the data on to the same channel then collision will occur and then you need to discard those frames and then maybe receiver will ask for retransmission of the frame to the sender. Now how this problem can be solved? So medium access control protocols tries to solve this shared access shared channel problem by having some access control protocols. There are two basic ways of solving this problem is shared channel can be allocated statically to a particular sender or that channel allocation can be done dynamically. The same channel allocation can be done in three different ways. You can have time division multiple access protocol where different time slots are given for the different nodes on to the network. Though the channel is shared the nodes will be transmitting in their own time slot only hence you will get that access for the channel available and then it will never happen that two stations are transmitting on to the channel same time. But the problem with this is if you are allotting time for a particular station but that station does not have any data to be sent in that case your channel will be idle. Others have data but others do not have their time slot and that is why other nodes are not able to transmit. So this is the problem with this TDMA static channel allocation. Another approach may be you may go for frequency division multiplexing where different nodes will be transmitting their data in different frequency bands. So if B is the bandwidth available made available by the channel then every suppose n different nodes are there in the network then B divided by n will be the bandwidth available to each node and in different bands the data will be transmitted by a particular node. Again we know that if the bandwidth is decided by number of nodes which are present as number of nodes increases in the network with the shared channel the bandwidth available to each node will go on reducing and we know that the data rate which you can get for your transmission is a function of bandwidth hence the as number of nodes increases the bandwidth will reduce and that may result into reduction in the data rate available. Another approach is CDMA code division multiple access where here some modulation is done by making the use of orthogonal codes though you are doing that modulation and that modulated data is transmitted on the shared channel simultaneously the collision will not occur. So these are the static channel allocation schemes but instead of going for the static channel allocation another approach may be you can have allocation of the channel dynamically as per your requirement you may go for allocation of the channel for a particular node. So this dynamic channel allocation can be done in two different ways either you can go for scheduling approach which may involve a protocols like polling for the channel after fixed interval of time or reserving the channel itself for a particular node these are the approaches possible and another way of having that dynamic channel allocation is you can go for some random access protocols. So the today's video session is based on this random access protocol one example of that random access protocol is aloha when it is aloha it is considered as a pure aloha and another counterpart is slotted aloha. Another approach for random access may be CSMA protocol or its improvement is CSMA CD now let us try to understand how this aloha protocol works so aloha is used for solving this channel allocation problem so there are two types of aloha one is called as pure aloha another is called as slotted aloha. So let us try to understand what is the difference between this pure aloha and slotted aloha. Basic difference is in terms of timing when you talk about the pure aloha it does not require as such global time synchronization in the next slides we will come to know what this time synchronization requirement is but here pure aloha does not require this time synchronization while slotted aloha does require this global time synchronization. At the end we will compare the performance of this pure aloha and slotted aloha also. Now let us try to understand what this pure aloha is it is a dynamic channel allocation where the whenever a node has data to be sent directly that node will send that data on to the channel frames are transferred completely at random times. You find here A wants to send the data A has sent the data B wants to send the data B has sent the data again A wants to send the data at this time so data is available. So you can imagine this axis is the time axis but with this you can find that let us talk about this particular interval what has happened here is C wants to send the data he C has started sending the data at this interval E wants to send the data E has started sending the data so those frames are sent but if you look at this time interval what has happened is C as well as E both nodes are sending the data on to the same shared channel so this will result into the collision but if I know that load of my network is very low so then this can be a very suitable approach where whenever you want to send just go on sending the data if you find that some collision occurs then you may go for retransmission of that particular frame so this pure aloha works as you want to send the data you send that data on to the channel maybe collision will occur so check for the collision and if you find that collision has occurred then just neglect that frame destroy and then use some acknowledgement or feedback so that you can have you check the status and then retransmission of the same frame will be done by the sender so this is how pure aloha works now if you look at the vulnerable period for the frame in case of pure aloha is you'll find that if at this instant some frame was sent and another frame this is the frame which collides with the start of the shaded frame so here is the collision which is taking place and again here you find collision it is collides with the end of the shaded frame so this frame has got collision this frame also has got collision so what is the vulnerable time for this pure aloha is from t0 up to t0 plus to t if t is the time duration for that particular frame which is resulting into the collision so this vulnerable time will be almost to t now the performance of this pure aloha can be improved by going for the slotted aloha in slotted aloha what we have is we have these time slots and any station can transmit its data in up at the start of the time slot only randomly you can send the data but it is not just when you want to send the data you'll be sending the data on to the channel but you'll be sending the data on to the channel at the start of the time slot so this is how slotted aloha will work so time slot is divided into slots and then this discrete slot so stations are synchronized to the frame so this is where this synchronization is required and then you transmit the data at the start of the frame interval at the first slot after the frame interval so arrival you will be transmitting your frame so this slotted aloha doubles the performance of the pure aloha almost vulnerable time period is getting half so this is how you can compare the performance of the pure aloha and slotted aloha so if you compare yes is the throughput what you get from the network and x is indicating the frame transmission time and g is indicating the load which is average of transmission attempts per x seconds so you find that if you go for the pure aloha the maximum throughput you can get is 0.184 but the same thing if you compare for the slotted aloha the throughput is almost doubled so this is the advantage of advantage in performance for the slotted aloha these are the references used for this presentation thank you


All right. Welcome, everyone, to Cloud Native Live, where we dive into the code behind Cloud Native. I'm Taylor Dolezal, head of Ecosystem at CNCF, where I work closely with teams as they navigate their Cloud journey. Every week, we bring a new set of presenters to showcase how to work with Cloud Native technologies. They will build things, they will break things, and they will answer your questions. In today's session, Richard and Citurum have joined us to talk about workload misconfiguration, the number one security threat when using Kubernetes. This is an official live stream of the CNCF, and as such is subject to the CNCF code of conduct. Please do not add anything to the chat or questions that would be in violation of the code of conduct. Basically, please be respectful to all of your fellow participants and presenters. With that, I'd love to hand it over to Richard and Citurum to kick off today's presentation. With that, please take it away. Okay. Hi, everybody. I'm Richard Cullins from Jetstack, Product Marketing Manager. Thanks very much for joining this chat. The idea here really is to, as you may know, Jetstack is the primary maintainer of CERT Manager, a very successful open source project that is used to automate X509 certificates for Cloud native workloads, and that particular project has huge community traction. We're here to talk about that, obviously. In particular, we thought we'd go into detail about where we see some of the potential security vulnerabilities that affect the way we see enterprises using Kubernetes. There's particular areas of information and research that we've identified and looked at more recently around that seems to identify that workload misconfiguration is a very general way that you can describe how vulnerabilities manifest within Kubernetes, but we feel that there is a particular context in relation to significant misconfiguration that we can talk about in detail during the time we've got here. But I'm now going to hand it over to Citurum, who's going to say hi, and he's going to take you through a demo that we hope you'll find interesting. Citurum, over to you. Excellent. Thanks so much, Richard. Hello, everyone. Sitaram Ayer. I am Senior Director of Cloud Native Solutions at Jetstack, a benefit company, and today I'm happy to be here to talk about some of the things that we've been doing at Jetstack, and also expand on some of the use cases scenarios that you use typically with CERT Manager and some of the add-ons of CERT Manager and how we can truly, truly build that zero-trust architecture more in the context of securing your mesh identities and how you sign those mesh identities utilizing the CAs or the reorganization CAs. Today, what I really want to do is walk you through, I'm hoping that you're all seeing my console, but really walk you through some of the things that you can really do today with CERT Manager and some of the add-ons, and I'll introduce those add-ons as I go through that. But at a very high level, the way I want to approach this is to think about any applications that are deployed in your Kubernetes cluster and potentially, let's say you have Istio as well as a service mesh that you have rolled out. How do you sort of, one, make sure that your ingress gateways are secured using a certificate that is approved by the organization? That's one piece. The second piece is also, how do you ensure that all of the workload search that are issued as part of your mesh workloads are also sort of secured and issued via an approved CA from the organization? When you think about it, very often that ingress gateway cert is essentially a publicly trusted certificate because more often you do have applications that are used via a browser or some sort of a mobile client, things like that, and mesh identities typically sort of are internal to the workloads or the internal to the organization or internal to the cluster. So very often you see them signed by an internal CA or a PKI infrastructure that is managed within the organization. So what I really want to do today is to break it up into sort of two pieces. One, where you set up and manage that aspect of securing the ingress gateway itself. And then the second piece essentially is to ensure that all of those mesh identities are signed using, let's say, Walt. So a hashCorp Walt as a way to sort of sign that. So you will see the installing cert manager obviously is installed on my node or on my cluster, rather. So I do have a brand new cluster that I've just provisioned about a little less than a couple of hours ago. This is running on GKE, as you can see. I will also install Walt. I'll also install Istio CSR, which is an Istio agent that we've developed when I set cert manager and add-ons. That's essentially one of the add-ons that facilitates signing mesh identities or facilitates signing mesh workloads. So that is something that I'll install as well. And as you can see, I do have my console open. I have my development window open as well, where I can see my make file. So I'm gonna be running a few commands essentially to sort of run through these various different aspects of building, configuring, securing, all of that. Taylor did mention that this is a part where we sort of try, break things. If things break, we fix. All of that will happen or everything might just work as I expected to work. So if something breaks, we'll fix it. But that also gives you the idea that it's all real and what I'm doing is actually on a real cluster with things getting set up and configured. So that's it. Keep bringing your questions. I'm happy to answer. Richard's happy to answer. Taylor's happy to answer. So we'll keep answering questions as they come in, but as a part of the demo itself, I'll keep going unless somebody sort of needs a question to be answered. If something is not clear, and I'm happy to do that as well. So like I mentioned, one of the first steps that I'm going to do is essentially to install Wart itself. And in this case, I'm going to be running Wart on my cluster. Basically, typically you would think about Wart running somewhere outside of the cluster, managed by an enterprise. In this case, just as a way to sort of demonstrate, everything is going to be configured running the cluster itself. Everything in the form of a make file, I do have a Terraform module that runs and configures the hash bar in this case. But as soon as that's ready, so we will be using that as a way to manage issuance for all of the certificates. And for those who are not familiar with CertManager, and Richard covered this a little bit, CertManager is the project that essentially is used as a way to sort of manage all of your certificates. It's essentially a certificate controller that runs in Kubernetes, helping you facilitate, manage all of your certificate requests and certificates that are needed very often as a common way to secure your ingresses. But we did one of the things that I wanted to cover also is, is the fact that it's not just used only for ingresses. We also have other add-ons that helps you facilitate or at least ensure that there are different kinds of workloads that are signed, different kinds of security mechanisms that organizations sort of drive. Security compliance that is required where some organizations require a certificate to be injected into a part so that the container that's operating within that part has access to a certificate that it can use. So we use the CSI driver. There is another project called CertManager CSI driver that essentially facilitates injecting certificates into the part itself. And that is a demon set that runs as part of the Node agent and helps you manage that aspect of things. So simply put, there's a few things that I have. Like I said, I installed Walt. So Walt itself is operating within the cluster. So that will help facilitate the requesting the identities. The second piece, what I'm gonna do really next is to run my next step. And before I run that next step, and as you can see, there are a few things that are happening here. I'm gonna set up a basically an identity or a certificate that will act or at least facilitate Istio to sign requests. So what I really mean by that is when you install Istio, the out of the box, obviously it comes with its own CA issuer that is built into Istio. What I'm really doing here is to utilize Walt as a PKI backend to set up that aspect of CA issuer. So when we install Istio eventually, as my next steps, when I install Istio, you will notice that the CA issuer that is part of Istio is gonna be turned off and we will delegate issuance of workload identities to cert manager. That is essentially what is going to happen. And in order to do that, I'm gonna prep and make sure that there is a certificate available, a certificate that is an issuing CA or an issuing certificate that will be configured and is ready for it to issue workload identities. Part of that is also where I'm going to install this Istio CSR, as you see, I'm now installing the cert manager Istio CSR, basically allowing adding that additional components to the cert manager namespace. So basically if you look at the cert manager namespace, cert manager is something that you're very, very familiar as I imagine. So something that's running already in my cert manager namespace. The CSI driver that I mentioned is also running because it's part of my bootstrapping process when I deploy my cluster that is also running. And the reason why you see so many CSI drivers as I mentioned is because it's a demon set tied to the nodes. The third piece that I just installed is essentially the Istio CSR as you see part of my step, which I just installed, it installed the Istio CSR. So it's up and running. The other piece that I wanted to really show you is this certificate resource that just got created. That was the previous step to creating the installing the Istio CSR itself. So this certificate that you see here Istio is essentially what we are going to be using for signing all of the mesh identities. This is no different than any certificate that you would typically create when using cert manager. That was the same mechanism that was used. The only difference is in this case, we use the vault issuer that is running in the Istio system namespace to issue that certificate. So so far all I've done is basically configure issuer which is very familiar to many of the folks who are operating cert manager, create a certificate which is also very familiar to a lot of folks who are using cert manager. The only difference is this specific certificate called Istio, it is also an issuing certificate because that can issue certificates on behalf of vault. It's essentially something that will be configured as part of the Istio CSR. So pretty straightforward what I did so far. So my next step essentially is to install Istio itself because what I'm now going to do is install and configure Istio using the Istio operator and I have to walk through what that configuration looks like if there are questions about it. But basically very simply put all it's trying to do is turn off the CA issuer that is part of Istio and then let cert manager take over the role of issuing workload writing please. I'm installing 114. So that's the one which I have the config for basically installing configuring and they should be pretty fast. As you can imagine, it doesn't take a whole lot of time to install Istio. You'll see Istio getting installed, you will see the Istio Ingress Gateway installed and the Egress Gateway installed as well. All of the various different components that are required for installing Istio will all be installed as part of this process. So straightforward like I said, all we did so far if I have to walk through configured a secret, configured the Istio CSR or installed it and then installed Istio itself. And then if I look at Istio system, so this is already running. So this is the Istio system that I just talked about and also since I mentioned that it's running on running on Google Cloud, we should also see a load balance or automatically getting provision should happen anytime. But basically allowing us to be able to map any of the applications that we are going to deploy via the Ingress Gateway and the Gateway resources that we will eventually be creating to allow access to the application. So nothing special here, something that you probably have done many, many times installing Istio. So something that the only difference in my Istio operator is that ability to utilize cert manager as a way to to sign the workload identities. The next step, as you see here, one of the things that we really want to do when we think about workload identities, obviously one of the things that people do or organizations really think about securing workloads is to facilitate MTLS. And within Istio, obviously there is this notion of a period of indication that you would specify what kind of mechanism or what kind of mode of MTLS you want to set up. Permissive, strict, pass through in all our different kinds of modes. The thing that we want to do here, especially as part of ensuring that everything is absolutely secure, everything is absolutely using MTLS is to set up that peer authentication with MTLS mode set to strict. And that is my next steps and all I'm doing is creating this peer authentication resource to ensure that it's MTLS peer authentication. Peer authentication. So if you see the MTLS mode is strict, that's essentially what we're trying to do here, basically ensuring that every time Istio injection is enabled for any of the namespaces, we will make sure that it is always using MTLS in a strict mode. That's essentially what I did in my step three. Step four, the next step, as I'm sort of building the scenarios here for you, what we really did just as a way to back up a little bit is set up or prep the environment to be able to sign workloads using cert manager for your mesh workloads. I did mention at some point about an Ingress Gateway as well. As you remember, the Ingress Gateway essentially is going to be something that is used as a way to access your applications typically, almost like saying my north-south way of communicating to my applications. So that is usually many a times browser-driven, app-driven, mobile app-driven, something like that. So in that scenario, I also need a identity for that specific endpoint or a DNS that is going to be configured as well. And in order to do that, I need somebody who can help me issue a public certificate. And obviously, many of you probably are using cert manager with Let's Send Crib for Acme as an Acme issuer, configuring the Acme issuer, solving your DNS or HTTP challenges and requesting certificates and managing it automatically. In this case, I am going to use Verify Cloud to get me a certificate for my Ingress Gateway. So basically, ensuring that there is another certificate resource that is going to get created, except in this case, I am going to use a completely different issuers. As you probably already know, many organ... You could have multiple issuers configured with multiple different configurations, each of them catering to different needs or different aspects of what you do in the cluster. And one of the things that I'm doing here is to create another issuer that allows me to issue publicly trusted certificates. And in order to do that, it's simple again, I'm using my own domain here, which is called sitram-ire.gcp.desk.net and the domain, the secret itself is called storefront-fast, basically allowing me to get that certificate, which is publicly trusted, as I mentioned. So we will inspect these resources as well. We'll look at what the certificate resources look like, how long are they valid, who issued that, all of that is obviously available for us to inspect and look at. But if you can finally look at the issuers, I do have two issuers, one which was the work that we talked about, the other one is the beneficiary issuer and you could have as many issuers. These are issuers, essentially, which means that these are names-based. You could also have cluster issuers that are cluster-wide, something that is very commonly used as well as a way to manage cluster-wide issuance of certificates so that people don't keep creating different issuers. That said, when you want to scope it to a certain namespace, put some R-backs around it, put some controls around it, put some policies around it about who gets to use, what domains to use. The other add-on for Cert Manager, which is also called a policy approver, which has the ability to define policies within your cluster to manage aspects of who gets to use an issuer for what domains and how they can request certificates is absolutely available. That is another add-on. I don't have it in my cluster today, but if I were to have that, I would have another resource called Certificate Request Policy that I could create and define how that would look like. And that also integrates with different kinds of policy approvers, policy framework. If you are using, for example, Kyberno or if you're using Venafype, all of those policy frameworks can be inherited or extended via those policy frameworks into Cert Manager as well. So that's essentially what it is. Basically what I really did was configure aspects of getting a public certificate, also setting up a way to request private certificates so that it's all tied into the identities that are managed within the application. So as you can imagine, I have a certificate, I have a domain that I'm going to be using as part of my Ingress Gateway. Something needs to tie in that Ingress Gateway, it's load balancer to the Gateway resource that I'm going to be eventually creating and mapping it to the DNS that I have in place. So which typically means having this specific DNS mapped to that Ingress Gateway resource, you know, all of that. And in order to do that, you know, I have, I do have another step here which is essentially going to configure that app DNS, it's a load balancer within Google Cloud, goes to Cloud DNS, sets up that domain, and then make sure that, you know, the IP address or the A record of that DNS has the value from the Ingress Gateway service load balancer IP address that was also created. And that's essentially what I'm doing in this next step. So as you see, I'm building over different things, basically configuring a wall, basically configuring is the OCSR, then, you know, setting up the peer authentication, and then also requesting public certificates. And now I'm tying in the load balancer IP address to the domain that I've created. So that way, you know, when I really hit that DNS or the IP address or the application that I want to access, it is going to get routed to the Ingress Gateway and eventually the resources that we are going to be creating. That's pretty much what it was, then what I did. My next step, obviously, is to install a sample application. And for those who are familiar with, you know, some of the demos from Google Cloud, you know, this is a slight modification of the Hipster Shop demo that is typically used as part of Google demos. So I've just used that, modified it a little bit to sort of, you know, to make it look like, you know, what we're doing more from an application that is slightly different. So you will see that when I show that. But basically, my next step is essentially deploying that variant of Hipster Shop into the cluster. There are a few other things that I'm also doing. I'm creating a gateway resource. I'm also creating, you know, the gateway resource that maps to that specific front-end service within the Hipster Shop. So that way, when we have the application that's accessible, you will see all of the identities and everything that are associated with it. So that is getting installed in the Istio CSR namespace. So that should be coming up, yeah. Still coming up, a few of them are still one of two. As you see here in this specific namespace, when we're deploying the application, these are all two of two. One because, you know, there is Istio injection enabled on this namespace essentially making sure that, you know, every single application or every single part also has the on-wipe proxy from Istio. So to make sure that, you know, there is that Istio aspects built into this. So this is the application that many of you may be familiar, you see when you see ad service, cart service, or recommendation service. So that is the general Hipster Shop application that you typically see once that's there. The next step is also again, optional, but basically I'm also installing all of the Istio tools. You know, you may, for many of the folks, you may be using things like Kiali or Prometheus or Eager, you know, all of those two observability tools that comes as part of Istio, something that you may or may not be using, but very commonly used as well. So I'm gonna install that. As you know, Kiali when it installs, it creates the CRDs first or it doesn't create the CRDs or CRDs are not available. So you do the two-time thing for installing Kiali. So now we should all install. So I'm installing Kiali as you see, I'm also going to install Eager, Prometheus, Grafana, all of the various different tools that are typically common in an enterprise, just as a way to tie all of them together as you see it. So what really happened now is things that I've installed and I've deployed an application. So you may have different mechanisms through which you're deploying, you may have all of this 100% automated and nothing stops you from automating. I mean, obviously, you can automate 100% of these things. There is nothing that I've done manually that requires any configuration changes or things like that. So I went from scratch of installing wall, configuring Istio CSR, configuring certificates, setting up, you know, MTLS strict, all of this can be packaged as part of your application development process, your pipelines that are already in place to help facilitate that aspect of, you know, deploying and managing the application. We will start to see a few more things, you know, when we originally sort of, you know, looked at certificate, we had two of the certificate resources that will continue to be the certificate resources that will be there for one to secure your knots out. The second one is the issuing CA. What you will notice is one of the other kind of resource that I did not talk about, I think now is the certificate request resources itself. And you'll see a lot of those getting created. And for those who are familiar with Cert Manager, you do know that every time a certificate resource is created, Cert Manager creates an accompanying certificate request resource that carries the CSR, that carries all of the information that needs to go to the issuing CA. And once that issuing CA issues the certificate, it brings it all back into the certificate request resource and updates the certificate resource and also updates the secret resource. Couple of things that are slightly different in the case of CSR driver and is the OCSR is that we don't necessarily represent all of those mesh identities or workload identities in the form of a certificate resource. They are only certificate request resources, mostly in the context of being highly ephemeral in nature. And you can pretty much turn this off as well to say, I don't want to preserve any of the certificate requests that are used for my mesh identities because we have hundreds, if not thousands of services that are running, there is no point in storing all of them, keep it in memory. We want to be able to track it for auditing purposes and things like that. So that is possible, but we don't necessarily have to store or store it as a resource and manage it. That's possible as part of the configuration itself. What you're really seeing here is an identity that was generated for each of these workloads, basically as a way to manage and update the workloads and everything. So that was pretty much what I wanted to sort of set up. I'm also now moving into my browser just to sort of show a little bit about what really happened from an application that we accessed. So if you look at my application, so this, like I did mention to you guys, there is this notion of a hipster shop that is very commonly used, I've slightly modified it to show slightly different things, not the products that you typically see from hipster shop, but in this case, I'm just showing you various different blocks and things like that and also how we operate. What I'm really doing is just generating some data so that we can look at all of this in Kialia as well and see how that manifests and how that shows the data. So this picture that you're seeing is essentially what I really did, basically having said manager, talk to various different issuers in this case. In the case of mesh identities, I'm using vault, in the case of the public CEA I used 205, you could potentially be using other mechanisms to sign my workloads, but then essentially having all of these MTLS facilitated as part of the mesh identity. So that was one aspect that I wanted to show you. I also said, I'm gonna show Kiali and I'm gonna bring that as well just to make sure that we can see information in a slightly different context, very relevant for the work that we just did. And what I'm gonna do, I'm gonna turn this security tab on as well. And if you see here, this says mesh-wide MTLS is enabled. My window may be two, all right, all right. Let's bring it a little bit, three sizes, excellent. All right, so you see this is showing mesh-wide MTLS is enabled and that was because of the peer authentication that we created. I'm also going to go a little bit of the last three minutes. This is no different view than what many of you maybe are familiar if you're using Kiali. What is slightly different here is this catalog that you see between the communication between services, you know, you say front end, there is cart service, you know, there is the ad service. And when I click on this, you know, you see that, you know, there is two different principles that have generated automatically. One, the source principle and the other one is the destination principle. These are S-weights that we generated as part of the identity for this specific service, essentially saying that this front end will be identified by the trust domain, namespace, the service account that it is used and the service itself. And that's the source principle which is being used to originate the request from front end to cart service which has its own S-weights and own identity. And all of these certificates are actually issued by, in our case, WART. And we'll look at, we'll inspect the certificate resource and see how that looks like. But basically all your, what you're seeing is my application that I deployed has been deployed. There was an automated way of issuing, managing certificates for all of these mesh workloads. And each of these mesh workloads have its own sort of identifier, a SPIFI S-WIT that is used as a way to generate the certificate via the STS-SR mapping it back to the organization's CA infrastructure even though I used WART it could be your organization CA infrastructure that is facilitating that. The Ingress Gateway itself, as you saw, is something that is issued, that is a certificate that is issued by Digisert because that's what I used as part of the configuration. And also in my case, I'm using really short-term certificates even for my Ingress certificate you see it's actually valid for only three days. And you might be wondering what could be the validity for all of these mesh identities. And if you look at that, but basically all of these identities that are generated for the S-Wits that were generated for all of the mesh workloads are actually valid only for one hour. So it is the responsibility of cert manager to continuously make sure that these certs are up to date. They are renewed automatically. They utilize the mechanisms of the automated mechanisms that you're already familiar with to renew the certificates for the Ingress but also for the mesh identities itself. So that was what I wanted to show and I'm gonna just quickly run through some of the commands as well. I did see one question come in that might be a good time to ask is cert manager, thank you Krishna for bringing this up. Cert manager, rotate certificates. Do you know how Istio deals with the root cert being rotated? Yeah, so in this, if you're managing, if you're managing Istio on your own and basically utilizing its self signed capabilities then it's your responsibility for rotating the root CA of the CA issuer, but if you plug in cert manager then you're essentially delegating that aspect of rotation and management of all of the certificates that are used for MTLS by cert manager. So there is obviously depends on what you're doing but if you are using the self signed capabilities of Istio itself then you're doing it but if you delegate it to cert manager, cert manager's responsibility to rotate that. Basically the cert that needs to be rotated is two faults. You know, one in this case, this certificate also is valid very for a short time so this will be automatically rotated but this is an intermediate but in the case of this specific scenario the certificate itself, the root CA is actually in vault so there will be mechanisms within vault where that certificate will be automatically rotated. So you're essentially outside of the Istio world where your root and the trust is managed outside and then there you have the ability to sort of manage it as part of your, any other certificate, root certificates that you manage on root multiple roots or all of your intermediates. So we essentially sort of separate that aspect of where your root and intermediates are managed and where your workload identities are managed itself. But just by sort of plugging in Istio CSR as a way to manage all of the identities you're essentially delegating that aspect of root CA management to whoever manages your PGA infrastructure. Hopefully that answers your question Krishna but I'm happy to elaborate as well that doesn't answer. Please keep the questions coming in if there's anything that you're looking to learn or just kind of wanna start a discussion upon a specific topic. Feel free to throw that in the chat and we'll get those questions asked at the best possible time. Yeah, thank you. Yeah, and then as I showed here basically even my intermediate is actually valid as you see here for only one hour so that's essentially how long that is valid. And if you notice what I did, I'm running CMCuttle which is the cert manager CLI too. Very helpful, very handy if you want to inspect your resources, inspect your certificates. In this specific scenario in addition to also generating an SWIT for this intermediate we also have a DNS name. But when I show you the actual workload identities you will notice that none of them have any subject information. They are all pure SPIFI SWITs, SWIT certificates that we generate. And then I can run that. Long command to run. I've made it part of my make files. So basically what you're doing is I'm just looking or inspecting, running a JSON path to pretty much describe that status of a certificate. So if you look at what I'm gonna see is a certificate that was issued for the Ingress Gateway up there. Where did I run it? Yeah, there is my command. Basically, this is the certificate that we are looking for the URI SPIFI fan that says that Istio systems, Istio Ingress Gateway service account and you'd see that this doesn't have a DNS name and anything like that. And that's typically similar with something like checkout service as well. So this is the identity of the checkout service. Again, if you look at the validity period, they're all valid for only one hour and cert manager automatically, if you don't specify any renewal before as part of the specification, will renew a certificate two thirds into the duration of a certificate. So if we hang around here for the next 30 minutes, all of these certs that are issued will be automatically renewed and there will be new sets of certificates that will be valid for the mesh identities and that is the responsibility of cert manager to automatically ensure that every cert is renewed, every cert is up to date and every cert is available for the mesh identities so that your application that's running here continues to operate exactly as it operates. And then as you sort of look at things, look at operating your clusters so you don't worry about managing the CA infrastructure as part of your Istio but essentially let Jetstack manage that for you. That's what I had showing for a lot of different things but I'll try and see. But I mean, just to summarize to one of the main reasons why this demo came together is, because a lot of people I imagine that are familiar with cert manager will be mainly familiar about the way it runs Ingress gateways and configures the Ingress capabilities in terms of workloads and where we're seeing a lot more traction and usage with the project is around being able to secure part to part and service mesh context around MTLS and that's driving, that's really driving a lot of the usage that we see in cert manager generally and what we were showing there were different interesting contexts around how MTLS is particularly being used with cert manager. Let me see another question from Satish and I'm, Jailor is okay to answer that now or did you have something to tell me? Say, I'm an on-prem managed Winify, not the cloud one. We also have Azure, Istio, Kyverno, build a solution fixed into the landscape, absolutely. So it doesn't, you could pretty much use the same mechanism that I mentioned now and very often some of the large enterprises who use a platform essentially to manage like a platform like Winify. In this case, you will have the CA issuer or a policy folder that you create in Winify catering to an Ingress. You could also have some sort of a sub-CA or a private PKI that you're configured as part of another policy folder, facilitating the signing of mesh identities, absolutely possible. You talked about Kyverno, yes, absolutely. If you're using that as a way to drive your policy framework and policies, the Certificate Request Policy Resource that I mentioned, which is part of the Cert Manager add-on as a policy approver can be integrated with Kyverno so that way you have a first-class way of managing policies that you already have and also tying it back to the Cert Manager use and how you essentially use Cert Manager. That was, yeah, so you're already using Istio, so I'm assuming you're running Istio on Azure and from the perspective of what I've shown just now, we are absolutely cloud agnostic. We are absolutely service measure agnostic as well, so Cert Manager and all of the components essentially run in any Kubernetes distribution. If you have any questions, please feel free to ask. I do have a couple here as well to kind of add to that conversation. Workload misconfiguration is often reported as being a repeated problem for many cloud-native platform operations teams leading to outages and even security risks. What's your take on the causes of workload misconfiguration in the first place? Yeah, Citroen, go ahead, yeah. Yeah, absolutely. So I think, thanks, Tyler, for the question. So tying back to some of the things that we just showed and if you sort of flip that a little bit and let the platform team sort of manage application deployment, development, all of that and also be responsible for, let's say, security as one of the things. And very often you see that people utilize configurations that are out of the box. And in the case of something like Istio, since we are in that context here, there is already a framework that is available. So people generally sort of say, all I need to do is check this box and then check the box and then I don't have to worry about it, but the challenge is somebody needs to have the ability to rotate those search. Somebody needs to ensure that it is always valid. And the other piece is also from a large organizations or enterprises which are regulated, they always have to play with some sort of a compliance. So there is regulatory compliances that needs to be adhered to. There are guidances that people follow, especially from a security perspective, whether it's the NIST guidelines or the cybersecurity guidelines that they have in place. So when the misconfiguration aspect essentially comes into play when very often we don't see that synergy between the security teams and the platform teams and the drive for things where everything needs to be driven from an organization security perspective. And that essentially translates to sometimes people saying, what's the best way for me to get a certificate? I can run open SSL, it's extremely simple. Or I can get a certificate with my email ID attached through some way and then it'll run, but nobody else knows who issued that cert, which CA was the one which was issued. So those misconfigurations and those configurations rather at the time work best over a period of time will cause a drift in some way and essentially cause an outage. And as we all know, if this application that I'm showing right now, if this were some critical business application, it doesn't take a lot of time before users start to complain about it's downtime and it's impact on the business and things like that. So those are some of the, obviously the reasons why we see certificate misconfigurations purely because the common way or the standard way of using sometimes just doesn't work. You just need to adhere to the security best practices and these are some of the things that we're driving from what we do. And we've seen what we've just heard they're born out in research. So I mean, perhaps a lot of people may have come across the red hat state of Kubernetes security report that came out last year, which asked that very question in terms of how many of all the enterprise that they surveyed, how many were experiencing a security related incident related to production Kubernetes. And 94% of them came back and said that they were of which misconfiguration and audit failure, runtime issues were all highlighted as being areas where that vulnerability had occurred. And given the complexity in scale that we're seeing across the whole ecosystem really in terms of companies that are deploying Kubernetes, a certificate is gonna play a primary role in all of those use cases. So it becomes quite foundational, we think, in terms of being able to have those, that level of best practice around certificate management in particular, to make sure that there is sight of where these misconfigurations can potentially occur. And so they don't, they don't manifest a security vulnerabilities, but that security report that you can Google on the red hat status Kubernetes security port. So it's got some pretty stark data. It's a very interesting, very interesting report to read. Awesome, thank you so much. I think one thing that I had a question on, I've really liked cert manager myself, I use that with many teams and just like that automatic ability to add certs and just kind of make things inherently more secure. In the past I've used let's encrypt and the vault methods, but I am curious are there any other clouds or is there any other support on the roadmap currently for, you know, for AWS and their cert manager or the other various clouds and everything on that front? Oh, that's a great question, Taylor. Yes, so the way we look at it, if you look at cert manager, you're absolutely right. The ACMEsure with let's encrypt is extremely common that we refer to as there are, there is a notion of out-of-the-box issuers that are available in cert manager. ACMEsure being one of them, Walt being one of them, Venafai being one of them, obviously CAsure, Self-Signed, they're all built into that. We also have community issuers. So recently there has been a development and there is an availability that people can use for what we refer to as an AWS PCA issuer. So that is being developed, that's available for people. If what I showed right now is something that is purely have to be used in the context of workloads running in AWS and people who are to use AWS PCA, there is an AWS PCA issuer similar to any other issuer that you would configure and the workloads will be signed off of that issuer. And very similarly, there is also a Google CAS issuer. So you can configure Google CAS issuer built jointly with both obviously Google and Jetstack. And similarly even the AWS PCA issuer was built with AWS and Jetstack. So there is the cloud specific or a service specific certificate issuer capabilities that are built into CertManager. So you just need to install those additional components and that will provide you the ability to interact with those certificate authority services that are native to the cloud provider. That's already available, yes. I think that's fantastic because I'm sure that anyone who's worked in the industry for a longer period of time I'm sure can remember the days where you'd pay 200, 500 or more dollars per certificate and then almost always would forget about it when it's time for renewal. So very happy we don't have to do that anymore. It's kind of wild. Cause I mean, even now with CertManager you could even set up something where like on Mondays, let's issue this way and on Fridays, let's issue that way. So really, really cool to see that that'd be wild to do of course, but really cool to see that you have a lot more options in terms of configuring or if you've other secure workloads or different kinds of concerns with deploying your applications, you know, you need this level of search or et cetera, et cetera that you have a lot more options on that front. So really cool, thank you. That's a, I've got to check that out. That'll be, need to take a look at. I did have a few more questions here too. And again, please, if you have any questions please feel free to throw those into the chat and we'll be sure to get those asked. A lot of engineers operating in their Kubernetes platforms will feel they have good observability of certificates in a cluster using a conventional dashboard. Kind of that same problem that we saw before, you know like is my cert gonna expire soon? How should people use these dashboards to monitor cert manager? Yep. Richard, do you want to take that? Do you want to answer? Yeah, I mean, I think it's a question for me in terms of the role of the person that is in control of the dashboard. I mean, is that person responsible for the end-to-end security about how the workloads are being managed amongst everything else they're doing. So dashboards could be, to my mind very, very sort of busy in terms of the data but they're providing a snapshot of what's going on within the cluster at that precise moment. And that isn't always going to give you the depth of information you'll need and able to be able to fully identify where a vulnerability might be at risk of manifesting. And for that element, you know, there are other tools I think that you can use. I mean, JetStack is very much invested in, you know in that area of product if you like. But yeah, essentially I think that it's a question to down to the capability to dashboard and the role of the person that you're relying on really, because from a DevOps perspective there's a lot of information across those dashboards and the security aspect of it could be requires a certain level of context, I think to be able to properly, proactively make sure that those misconfigurations and those vulnerabilities are being mitigated. Which is really helpful. I think that it's important to have that observability and to monitor and to kind of get a handle of what's going on within your systems. And I like what you said, you know, just about the role like what's the problem you're trying to solve? What are you trying to do? I think that that's always really important to kind of have an idea of before you start looking. You know, if I don't know if I'm looking for my car keys how do I know what I'm really looking for, right? So that's a great point. And, you know, a cert manager makes a lot of these things automated as well. So that worry about certain contexts kinds of either fades away or is less of a concern. You know, if the controller has a problem or something like that then obviously we'd want to take a look, but. Yeah, I think just to add to that, I mean, audit capability is a context that isn't necessarily the primary kind of focus of a DevOps engineer if you like, but that level of observability for audit is needed elsewhere in the security organization, of course. And of course, you know, it's a question whether or not a dashboard is the right tool to be able to deliver that kind of information to inform security policy, for example. Personally, I prefer things delivered by carrier pigeon but that's just me, that's just my personal preference. I did see a couple more questions dropping in the chat. Abhishek, I'm a student, want to make a career in CNCF. Fantastic. If there is anything that we can help out with definitely would love to be of help. I know that we support a lot of projects and workflows and clouds. So if you do want to just take a look at that l.cncf.io will kind of show the whole landscape. And I believe that some people have actually made a puzzle out of that graphic. So I don't know how many pieces. I think it's like a thousand or maybe even a hundred thousand who knows, but really interesting to check out. Uncur asked, sorry, joined a bit late. May I ask if this works with Azure Kubernetes service, AKS, that managed instance? That's one I think I can answer. Yes, one thing that's really nice about cert manager is the fact that so long as you're using Kubernetes you can install that within that context. So no matter what cloud, even if it's something that's on-prem you could integrate that with Let's Encrypt with Vault as we saw a little bit today. And you can check the session out afterwards too. We make it available on LinkedIn, Twitch and YouTube. So you can kind of take a look at that demo if you join late and miss that. But are there any questions that you all get in terms of that? Do you support this kind of workflow or do you kind of plan anything outside of Kubernetes at that as well? Have you seen people use this in non-conventional ways to issue their certs? Yeah, it's an interesting question because recently I was engaged in one of our prospects of the customer now. The way they use cert manager is pretty interesting because cert manager is their source for issuing and managing all of the certificates. But they do have different consumers, consumers that are not always using Kubernetes because there are consumers who are working in classic applications, possibly requiring certificates for some load balancers, for some patchy instances or engine X instances that are running. So there are a lot of different consumers who basically need a certificate for their applications, but in this specific scenario, so basically what this person, I would classify him as an advanced cert manager user, has built an operator that essentially pushes and makes available a certificate that is generated, managed by cert manager to any of the consumers who are operating in non-Cubernetes world. So there are people who use cert manager in very creative ways, but we do get asked about, obviously questions around how do we sort of do this, where service mesh itself is not running in Kubernetes. I don't know how many customers or how many enterprises are trying to run service mesh in a non-Cubernetes environment, but that's something that has come up a couple of times. I don't think we do anything outside of Kubernetes at this time, but that's where we are most of our focus or almost all of our focus, but there are people using cert manager as a way to cater to consumers outside of Kubernetes. So that's very interesting to see. That's always fun. It always intrigues me to see people use things in ways outside of what was previously thought of, not following that like happy path kind of development. So, and in some cases, it leads to some really cool development. So that's really interesting to hear. I'm also always fascinated to hear about service mesh used outside of Kubernetes and really just what teams are thinking on that front. So that's really appreciate those insights. That's fantastic. So Satish, I did answer that question a little earlier as well, because it's also the separation of duties. Yes, you're right. So if you are using the built-in capabilities of more of a service mesh, you have to restart the Istio parts. The fact that all of your CEA configuration and the CEA aspect of signing mesh identities and assigning your ingresses, they're all outside. So you pretty much operate in a way where there is Istio and that there is the infrastructure to support the security aspects of what is managed within Istio. So we do have enterprises, large enterprises using this in the context of ensuring that there is zero downtime for all of this. Yes, it is possible. Awesome, awesome. I did have one more question to kind of round things off, but do you want to encourage anyone to get in their last minute questions as we start to wind down the stream? What's happening at KubeCon this year for the circuit manager team? I know we have KubeCon EU coming up here soon and may definitely book your travel if you haven't yet. I saw the hotels were already starting to fill up. I got my reservation, but I'm about, I think like 47 minutes via public transport to get there. So I just got to grab breakfast a little bit earlier. So looking forward to seeing all of you there. But yeah, what things do you have planned? We have quite a sizable team going to be there this year. So we're lucky enough and thanks to the CNCF for giving the project its own booth and the project affiliate. So for people that are attending, they can come into the project booth and they can talk directly to the maintainers. We've got a pretty good representation from people that work whose full-time job it is to maintain and develop the circuit manager project. So definitely encourage people to come along and say hello there and stop by the jet stack stand as well because we'll be there to talk about everything else that we do in relation to our open source work and everything else. We've got talks going on at the main conference as well as a couple of the co-located events. So yeah, it's gonna be a very busy week, but you'll certainly see a few of us there if you're attending to go along yourself. Awesome. Is there any, and another question, I said there was just one, but I had another one, in terms of the, so it's jet stack, but I've heard rumors about you having jet packs as swag at your booth. Is there any confirmation that you're not on with that? That's a great idea. Why didn't I think of that one? Wow. That's a great idea for your return. We're talking about cloud native development, right? It's all in the sky. Yeah. I'm gonna have to look into that one, Taylor. I think it's a great idea. But, and then I'll have to like, look at my budget too, of course, but. I've heard a lot of crazy announcements around Friday, April 1st. I don't know what the relations are on that front too. Awesome. Yeah, the guy that does the gravity pack, you ever see him? I don't know if you know, but. Oh, yes. His company's not too far away from my lips. So I'll nip down the road and ask him if I can borrow it for a week about that. So. That'd be so funny. Awesome. Awesome. Well, I don't see any more questions today, but I did want to thank everybody for tuning in to our latest episode of cloud native live. It was great to learn from Richard and Citram. We really enjoyed the interaction and questions from the audience. Thank you all for showing up. This is you, you, the community make this possible and really fun, really enjoyed your questions. Next week, we're going to be joined by Andrew McGuire to learn about how to power up your machine learning with automated anomaly detection. So that should be fun in terms of monitoring and everything else. I want to thank you all for joining us today. We hope to see you again soon and wanted to ask you if you have any, any last parting words of wisdom, either of you. Well, I mean, we're, we're a very popular open source project. We've got a great website that's just being refreshed. We'd like to encourage everyone to check out certman, cert-manager.io, a great resource. Our Slack channel is very, very busy as well. So I would encourage people to join the Slack channel and or come to Citram and I directly if you've got any other questions as well. Yeah, please do that. Absolutely. Yeah. Happy to answer any questions, not just in this form, but yeah, reach out via Slack or you know, on the Kubernetes Slack channel. So we will have to answer the questions here. Fantastic. Fantastic. Well, thank you both so much for coming on today and for talking about cert-manager. It was fun to get those questions answered and you know, get demos and get a little bit more insight into the project and fantastic. I'll definitely make sure to see you at KubeCon. And yeah, thank you. Thank you everybody for tuning on in. We'll see you again soon. Thanks very much. Thanks everybody. Bye-bye.


Live from Houston, Texas. It's theCUBE, covering Grace Hopper's celebration of women in computing. Welcome back to theCUBE's coverage of the Grace Hopper Conference here in Houston, Texas. I'm your host, Rebecca Knight. I'm joined today by Isabel Moulinier. She is the Director of Innovation at Thomson Reuters. She's based in the Twin Cities. Welcome, Isabel. Thank you. Thanks so much for joining us here. I'm happy to be here. So let's talk a little bit about your career and where you got to be where you are today. Okay. You grew up in Paris. I did. And did you always think that you would become an engineer? Was that always part of the plan? Not at all. When I was a little girl, I was building birdhouses. My father was in woodworking. That is early engineering stuff, I'd say. I guess so, but not computer engineering. Okay, fair enough. I did get my fingers quite a bit with blades and things like that. So I decided it might be a little bit too difficult for me or too dangerous, I would say. And so then I was a studious person and I liked math and physics, not so much language. So I ended up going into an engineering school that was focused on computer science, economics and math. It was a bit of an accident. In France, they have a system where you took your national exam and if you're a genius, you can pick wherever you want. I'm not a genius. And so I picked whatever I had the best access to. And that was engineering? And that was engineering. Okay, okay. So then you graduated from engineering school and did you go right into, where did you land from there? So during my last year of engineering school, I got lucky. I got to do a semester at Oxford University. And that's where I discovered what research might be like. So I was in the masters of computation there and I really liked it. So when I went back to France, I decided to do a masters in programming languages. And then I landed an internship at IBM. They had a research center in Paris at the time. And after that internship, I also landed a PhD grant from them. And so that's how I got into graduate studies, just a little bit by accident because I was at IBM at the right time when they were giving their last grants for French students. So some deliberate decisions, a little bit of being in the right place at the right time. Exactly. So now you are here at Thompson Reuters, director of innovation, product innovation. And you're also a research scientist. Tell me, what do you do? What are you working on? So right now I'm working on looking at the possibilities of blockchain. Blockchain, very hot topic. Super hot topic. Explain to our viewers out there, what is blockchain? To put it simply, I like a quote from Richard Brown at R3, blockchain is a technology that allows two parties to know that they share the same facts. Okay. And so that in practice, that is... In practice, if you look at the banks, it means that what they have on their ledger. So if bank A has the same information on their ledger, then bank B has. And you don't have to do reconciliation. And right now there is a lot of work in the reconciliation. And so that's why blockchain is so disruptive in financial services because they're kind of removing the middleman. What I focus on is not finance. It's our legal and tax and accounting businesses. And so on the tax and accounting business, we actually have a government entity, branch, sorry. And we look at land registry. Can we bring some anti-corruption aspects and transparency aspects to the land registry, especially in developing countries? So that's one of the projects that we've got going on. So automating contracts. Automating contracts that represent real properties. Okay. And then you can also track who changed the contract and the property so that the land cannot be stolen from other people. You said you're focusing specifically on the developing world. Is this a particular challenge in developing nations? It's, well, corruption is a challenge. Not everywhere. Don't get me wrong. In particular, the land issue. For the land issue, what we find is that land is a great drive for economic development in countries. And so if you can help with that, then people can then get financial security and then you can help development overall. Okay, okay. And that's what you're doing. We're looking at the technology part of it. Yes, I'm not going to save the world at this point in time. Okay, all right, fair enough. Talk to me a little bit about your leadership as a woman engineer at Thompson Reuters. Okay. And how you, I know that Thompson Reuters has a lot of programs, internal programs to mentor its employees and to retain them. How do you fit in? Because you're not an HR, you're not running these talent programs, but you are someone who's down in the trenches doing the work, has worked closely with women and mentored women. How do you approach it? So it's funny, you mentioned that because I just had lunch with a couple of women and we were trying to see how can we develop a program that technologists would adapt to themselves. And so we were talking about this idea of having technical leadership as opposed to people leadership and how do you develop technical leadership in an environment, especially for women? And so the idea is everyone can be a leader. You don't have to be a manager to be a leader. And I learned about that when I was part of one of those talent or HR programs that Susan Ali Davis, who's a part of ABI as well, has put together, it's called leadership one. And I was having a hard time figuring out what am I doing here? Because a lot of the people were managers and they were dealing with people's issues and I didn't have any reports or anything. And I was struggling with what does it mean to be a leader in technology if you don't have reports or if you don't have people? And then I realized it's all about the networking and how you learn the trust of the people you work with. And so really at Thomson Reuters we've got a culture where we talk about the shadow of a leader and the shadow that you cast is the respect you get from others basically. And so you can become a leader by earning trust and respect from others. And then you can share that by exposing younger people, making introductions all the time. So I'm always in the hole introducing people to each other that don't know people. So that's what I was going to ask you. That sounds like such good advice, such common sense advice, gain the trust of the people you work with, the people you work for you, the people who you work for. How do you do that? As you said, you work hard to just make sure that you are constantly introducing people and making sure that other voices are heard. What other ways do you build trust? Because that is something we keep hearing over and over again, the importance of trust. So one of the things is when you work with customers you have to deliver. If you don't deliver, you're not going to gain their trust. So delivering on what you promise is a great way to win trust. And it doesn't have to be a big delivery. It could just be by the end of this week I'll have this report for you. Or going out of your way to look at some area of technology that you're not very familiar with and then write a white paper about it. So there can be small steps. They don't have to be big steps at all. You're here at Grace Hopper, which is the best and brightest young minds in technology today, represented from 83 countries around the world. And we're here, Google is here and Snapchat is here and Microsoft and all the hot companies. How do you compete in the sense of what do you say about Thomson Reuters? In the sense of what would make someone want to work there and be a part of the problems that you're trying to solve? Very good question. We struggled with that a little bit from time to time. One of the things that we do very well at Thomson Reuters is we have the... One of our principle is the trust principle. So our new services are trusted. Our financial services... Because of the partnership with Reuters, yes, yes. Our lawyers trust our products to do their research and to go defend cases in court. We also have a foundation, the Thomson Reuters Foundation, that focuses on issues that are very important. So if you're somebody who wants to try to change the world, or you have very strong interest in women's rights, the Foundation has an event every year for that called Trust Women. If you want life balance, which sometimes is nice to have, it's a great place to be. We do have crazy hours from time to time, but usually we don't have crazy hours. It's really the exception because... Not the norm. One of the other things that is really good at Thomson Reuters is we're a multinational company. And so you get to work with people all over the world. In my own experience, I worked with Japan, Australia, China, Latin America, South America, Europe. So I get to interact with multiple cultures very frequently. And you're also doing some cool stuff.  And you're also doing some neat partnerships with IBM. Right, exactly. So one of the things we are trying to do right now is we're setting up a new center, which is applied research in Toronto. We currently call it the Center for Cognitive Computing. And that's where we're going to take a new generation of products, where we rely more on the technologies like machine learning, natural language processing. And we currently have experiments going on with IBM Watson. And so we're partnering with... Can you talk a little bit about the experiments? What you're trying to figure out? Yeah, so we're trying to understand how we can apply that technology in order to deliver better products for our customers. So our customers are professionals. They're not end users. But as the new generation that has grown up with Google and Facebook comes along, they want their professional tools to look the same. Yes. And they have higher expectations. And they have higher expectations, exactly. And so one of the ways to do that, we cannot have a thousand researchers at Thomson Rider because our area is not research. So what we do instead is we partner with the best and brightest companies out there in order to amplify what we can do and use the technology to amplify what our customers can do as well. Can you give us an example of what that looks like in the sense of a tool for either a lawyer or a finance professional that has this amplified human knowledge? Sure. So to some extent what we did with our search engine was already a step in that direction. So when we reworked the Westo search engine, which was a legal search engine, what we did is we looked at all the information that we knew about our customers and then all the information that we've poured into our content because we have editors and we have machines extracting information from our documents. And then we merged the two and then it gave us a better search engine. More closely now, you've got all the virtual assistants, right? And so when it be cool if you're in a law firm and you need to build your customers, you don't need to type anything.  Right, right, exactly. That makes perfect sense. So those are the types of experience that we want to provide to our customers. Finally, just your thoughts on this conference, 15,000 people from around the world, is this your first time here at Grace Hopper? No, it's my fourth time. Your fourth time, okay.  I am, to some extent. How's the vibe this year and how does it compare to years past? Do you feel that we are, are people talking about the election or people talking about court cases that we've seen in Silicon Valley this year? I mean, what's the vibe? So people are definitely talking about the election, especially foreigners, which is quite interesting. You haven't been here 20 years.  I'm not. No, but like some of my British colleagues and things like that. Yes, yes. Or British participants, not just my colleagues. Yes. So I want to say I'm really impressed by the growth of the conference. The first time I went was four years ago in Minneapolis and I think we were less than half this size and every year it's more and more young people, young women, more and more energy. And one of the things that I really appreciate with this year and last year is including male allies. Because one of the things is women won't be able to change what's happening in technologies. There are not enough of us, right? And so if we can bring male allies to the conference as well, that's a great asset. And there is a great keynote on Friday which I'm going to miss, unfortunately. So I will be watching the stream. Mark Benioff, yeah, that's Salesforce, exactly. And so once we have allies, I think we'll see an even bigger effort around the conference. So we need men too, if we're going to make a change, we need men too. Yeah, they all have daughters. Isabel Malignier, thank you so much for joining us. Director of Product Innovation at Thomson Reuters. We will be right back with the Cube's live coverage of the Grace Hopper Conference in Houston, Texas after the short break.


The highest paying business career tier list. Today we're gonna be talking about different business related jobs that you might go into if you are a business major in college. And some of these are going to be jobs that you can get into without getting a college degree. So I'm gonna be breaking that down whether you need a college degree, whether you don't need a college degree. I'm also gonna be talking about really important things like how much you make, the flexibility, et cetera, et cetera. And if you appreciate videos like this, go ahead, tap that like button. Let's see if we can get 1,000 likes on this video. I'm also gonna keep this one short and sweet. I make tons of other videos where I go in depth on this stuff. So if you wanna know more, just subscribe to the channel and you'll see those. And let's jump into it right now with the first one on the list, which is gonna be the highest paying one. And that is founder or CEO. Now this one is a high risk, high reward type of career, starting your own business or going into a business that is already successful and becoming the CEO. Definitely not for everybody, but you can make a ridiculous amount of money, of course, as a CEO. Last year, Elon Musk's net worth went up by $100 billion in a single year, right? So the sky is pretty much the limit when it comes to how much you can make as a founder or a CEO. But just know that something like with small businesses, I think 70% of businesses fail within the first 10 years. And with like more startup type businesses that are kind of like shooting for the moon, it's more like 90 to 99% of them are gonna fail. Now, typically the advice I give on this is go ahead, get some work experience first, build some skills, figure out what you wanna do with your life and then try to start your business. But yeah, this one goes into S tier for sure. Really good one. Accounting is next on the list. Now, remember I'm talking about the highest paying, right? So I'm putting more of an emphasis on high paying careers. Now, if you get an accounting degree, you can go the accounting path or you can go the finance path. And typically finance is gonna have the higher paying careers. But there is still some pretty good ones if you go the accounting route as well.  Next one on the list is going to be finance. And this leads to some of the most lucrative career paths you can go into in the entire world. If you go down the private equity, venture capital, hedge fund, investment banking route, you can literally make millions of dollars a year in your first like five to 10 years of your career. But I will say that this is for A type personalities, people who don't mind working at least 60 hours a week, right? Like that would be the minimum. And in a lot of cases, you're gonna be working 80, 100, maybe even 120 hours a week if you go into something like investment banking. So yeah, finance definitely goes into S tier. This one is incredibly high paying. Next one on the list is going to be sales. And this is one that I absolutely love because you can get into sales without a college degree and without any experience. So I just recently interviewed Abdul, for instance. I'll put that one up here in the corner. And he got into tech sales with no college degree, no experience. And within his first year, he was making over $70,000 a year. So I will say that if you go into sales, you want to be selling high ticket products. And typically business to business is a good way to go, especially if you're in an industry like technology. And sales as a skill set in general is just one of the most valuable skill sets you could possibly learn. It's the most common type of job that millionaires and billionaires have in common in their past. Now tech sales is also referred to as sales development representative or business development representative. And if you type in business development at the entry level on LinkedIn, you see there are 409,000 results. Companies badly need people to get into tech sales. And that's why my friend Troy at course careers actually made it incredibly easy by creating a company where he trains people and then he gets you interviews with companies that he partners with. And that's why he's able to get people jobs in sometimes one to two months, starting off in tech sales. Now, if you want to learn more about tech sales, Troy does have a free training. I will put that down in the description as well as the pinned comment. And if you want to use his service where he trains you and he gets you interviews, which just speeds up the process quite a bit. I do have a $50 off coupon and I think the code is Shane 50 and I'll put that down there as well. So yeah, this one I'm going to put an S tier as well. Next one on the list is going to be consulting. And this is a career path. A lot of people go down, they work at one of the big four consulting firms. Now, this is another one that's pretty competitive. You're going to be working pretty long hours because you're going to be consulting with large businesses on your area of expertise. But with that being said, this one can be really good. It can also lead to much higher positions. You can specialize in something and then get hired by companies and get paid really good money. So consulting is going to go into S tier. Next one on the list is going to be entrepreneurship and small business. So before I talked about kind of a CEO or a founder, I was more talking about the startup role. But honestly, starting small businesses is a really good option as well. You have a much higher chance of success if you start a small business. And a lot of people start a smaller business that's sort of a cash flow business that they can rely on. And then they start their fancy, you know, startup type business later on down the line using the funds from their first business. So yeah, this one I'm going to put in S tier as well. Human resources is the next one on the list. So this is one where I don't like the degree very much because you can actually get into human resources with a bunch of different degrees. You do not need a human resource management degree. But with that being said, the career itself is pretty decent. So I'm going to go ahead and put this one into C tier. Next one on the list is going to be the broad category of marketing. So marketing can be pretty good. Very important skill set to learn. Overall, I'm going to put this one in A tier. Next, we're going to talk about the specific category of digital marketing. Now all of the other types of marketing are A tier, but digital marketing specifically, in my opinion, is the most valuable type of marketing that you can learn. So digital marketing comprises social media ads. So think, you know, ads on Facebook or Twitter, et cetera. Also Google paper click ads. So those are the ones that show up on websites or on Google when you search something. And then search engine optimization, which makes websites rank organically when you search Google. So yeah, digital marketing, super, super valuable. And the best thing about this is you do not need a college degree to get into digital marketing. So because of that, you don't need a college degree. You don't need any experience. You can get really good paying jobs. There's a ton of demand. This one is going to go into S tier. Next one on the list is going to be real estate. Now I definitely do not recommend getting a real estate degree. No, God, please no. However, real estate can be a good one to go into. It is relatively entrepreneurial. So there's certain types of personalities that do really well in real estate. So it is a little bit of a high risk, high reward type of career, but overall it has pretty high job satisfaction. If you are successful in real estate, you can make good money. And if you don't want to go full-time in real estate, some people will just get their license and do it part-time on the side. And then whenever their friends or family want to buy a house, they'll use that person as their real estate agent. So this one is going to go into B tier. Next one on the list is going to be working in retail. So this is basically something that you do see somewhat commonly. I do have a good friend who started off working in retail, rose up the ranks there, got into a management position, and then transferred over to another company, got an even better management position, and then transferred into a Fortune 50 company. And he basically got an associate's degree in business. But with that being said, it's not the cleanest or easiest route to go. There's a cap to how much you can make. It is difficult to transfer over into other positions. You have to deal with Carons all day. Nobody really wants to work at a retail store, so people are constantly calling out. And if you work in retail, you know what I'm talking about. So yeah, this one goes into F tier. Next one on the list is going to be an executive. So not necessarily the CEO, but somebody who's high ranking within a company, like a vice president. So very difficult position to get into takes years and years in order to get into this. But with that being said, executive can be a phenomenal career. And when it comes to high paying careers, which is what this video is about, it's obviously gonna go into S tier. Next one on the list is going to be management. So this is somebody who's kind of like mid-level within a company. Now managers absolutely can make really good money. This one is gonna go into A tier. Next one on the list is international business. This is a dark horse candidate. I could see this one doing phenomenally well in the future. But right now, just from the numbers that I looked up, not as good as you would think, but still not bad at the same time. This one goes into B tier. Next one on the list is going to be logistics. Super, super important one. This one goes into A tier. Next is gonna be project management. This is where you basically are the lead of a project. Not an entry level role does take a few years to get into it, but a really cool career teaches you a lot of what you need to know to move up into higher positions within a company or start your own business. So project management goes into a B tier. Public relations is the next one on the list. Not as much opportunity in this one, but it's not bad at the same time. This one goes into C tier. Sports management is next. Super, super competitive. Very difficult to have success in sports management. But if you are able to have success, you can make a ridiculous amount of money. But overall, not sure if this one's worth it. This one is gonna go into D tier. Sustainability is next on the list. And I see this one being another dark horse candidate in the future. A lot of countries are moving towards incentivizing businesses to be more eco-friendly. And companies are trying to figure out how to maximize their profits, but at the same time be friendly to the environment. So sustainability goes into B tier. Next one on the list is business teacher. So maybe you would get like an education degree in business, something like that, teaching a high school. And with this one, I'm sorry, but you cannot teach business unless you've done it yourself. It's just one of those things where it's like riding a bicycle. You cannot learn how to do it unless you've done it yourself. The only way to learn how to ride a bike is to jump on a bike and try it. So this one goes into D tier. And then data entry. This is a very, very low level business job that you might go into as your very first job ever. There's just not that many upsides to this job. The low pay, very boring. You're not really learning any challenging skills. It is just mind numbing work in my opinion. This one goes into F tier. Now, if you're interested in looking into the business route, check out this interview that I did with Abdul. I'll put it like right here, I think. And like I said before, he was able to make $70,000 a year in his first year working in tech sales. And I'll see you over there.


Do you feel like that mentality exists? Or is that something you're going to have to, and how do you make it happen if you don't feel like it's necessarily there yet? They can get there, but how do you get them there at that mentality? Well, I mean, I think most coaches say that. You know, I always joke like nobody says they want a really slow, soft football team. You know, it's like when an announcer says, hey, we want to start fast. Yeah, you know, nobody ever, no coach ever goes in the locker room. Guys, let's really like ease into this one. So same thing. I think you got to get tough players as you're going through the evaluation.  That's part of their habits they have coming out of college or other teams. It is something you emphasis and you got to hold guys to that standard. But that is part of it too. You know, you hope to have enough guys and it's a point of emphasis. And you hold your best players to that standard. You talk about holding people accountable. But it's certainly, you got to go get some tough guys. It helps. That's funny you say that because I remember one of the questions I got asked as a player. So do you guys think you can really win this game? So that's, that's along the same lines with you talk, no, we're just practicing to go out and get a kick, right? Yeah. So I took something out of our last time you and I had this chance to discuss things and you were talking to the high school coaches and you got to ask the question about where do you get your ideas? Where do you continue to evolve on the off with plays and formations? And I was very interested in hearing how many different things you look at. Would you talk about that a little bit? Sure. That's what's fun about this time of year. Obviously we're in year one and we did a deep dive in our own roster and our own schemes that were run here as we're going through our schemes now in all three phases. Now you get into the college evaluation and it's fun to go around the country and see there's a lot of ways people move in football and you look at, you look for ideas and makes you think, makes you kind of challenge what you're doing. Do you really have conviction? We do, but we've also been able to adapt and expand and there's some really creative coaches around the country and it's fun to go watch other people and say, hey, this is kind of a good idea that this kind of fits the personnel or who we got or, hey, I've made archive this for another day, this doesn't really fit us right now. But anything, I mean, you know, I look at stuff in other sports that I think can apply to football a little bit. You know, one thing we used situationally last year I kind of stole from Roy Williams in North Carolina I went to North Carolina, I'm a big basketball fan and I always think of this play that Luke may hit, you know, it's always the old argument do you call time out? You know, that's a subjective argument. You know, the game was tied, they go, defense not set and they pushed the ball in court Luke may hit beat and we beat Kentucky ironically down in Memphis I was there to go to the final four. And the same thought we had last year playing at Houston and it's the same thing whether you clock it or keep pushing and we kept pushing it. Same thought, thought we're going to clock it, pushed it, and Ryan and AJ made a hell of a play and took us to overtime. So those are all the decisions you make, you practice but that's just one example of something I stole from basketball and really Roy Williams I have to give them credit for that. That's cool, that's really cool. Need insight there. Okay, so a lot of travel for you this year no combine, you're not going to get a chance to do a lot of pro days. How much does that kind of change up? Is that something you're looking forward to doing?  Well, it's important to get out. You know, we can't go meet with the players in person. That's the closest thing we can, at least we can see some of these guys work out which helps, it's just part of the process.  You can watch your film anywhere. You know, you could be in Mexico city as long as you got wifi, you can watch, you can watch film and so it helps the experience to have last year to understand how productive you can be. If you got to work from home, you got to work in an airport, hotel, you can find time to do that. Well, Arthur, that's all I had for you, man. I appreciate you taking the time to do this and I hope we didn't keep you too long because I know you're trying to grind and get ready to go play and win games but thank you for your time. Thank you Dave, I appreciate your time.