So, as I said, my name is Robert Wood. I'm going to be talking to you guys about threat modeling in general as an assessment methodology and how it applies specifically to the gaming industry, mostly because gaming is a very unique industry in that the business risks are oftentimes very, very different than financial services or healthcare or ISVs. So that was the primary driver behind evaluating the gaming industry because in any kind of security assessment, we need to make sure that we can map risk back to business risk or vulnerabilities back to business risk. And being able to accurately and correctly do that is going to be what helps us as security professionals change our industry and actually improve things instead of just saying, you know, you're all wrong. So this is our high level agenda for what we're going to cover today and we'll do questions at the end. So, threat modeling. Who here just by show of hands has ever been a part of, you know, building a threat model within your company or for another company? All right, excellent. So a number of hands went up.  And a threat model identifies, you know, functional and logical components of a system and how those things fit together, trust boundaries around those components, a trust boundary being a system boundary or a network boundary. And what we want to use threat modeling for is a way to identify all of the various, you know, mechanisms that a threat agent can use to target a set of, you know, critical assets. And it's mostly focused on identifying design flaws. And from what we've seen in practice actually doing threat models versus more actionable and interactive assessment things such as source code reviews or pen testing, reverse engineering type assessments, is that design flaws end up constituting about 50% of the overall vulnerabilities of a given system.  So obviously, you know, we want to make sure that we have adequate coverage across an entire system. So this is some of the, some of the verbs that we're, or some of the syntax that we're going to use throughout this conversation and, or throughout this talk. And I'll go through and describe what some of these things are throughout and right now. So an asset is anything that's sensitive that we need to protect. So that could be either sensitive information like credit card information, like source code, like healthcare records. It can also be a set of sensitive functionality that we need to protect. So consider Amazon's AWS. They have internal APIs that they can use to do EC2 instance memory snapshots, for instance. That's a very guarded API that you want to make sure that, they want to make sure that, you know, somebody on the internet doesn't have access to. So asset, something we need to protect. A control is something that is in place to protect a set or a single asset. So input validation could be considered a control. TLS on network connections is considered another control. A threat. So there's a lot of different definitions out there for what constitutes a threat. In this context, we're going to refer to a threat as an agent who uses an attack factor to compromise an asset, you know, through some component. Okay. So throughout our system, if you consider a much bigger system, as opposed to just an attacker, this little simplified diagram here, an attacker might go through multiple components and bypass multiple controls to get to an asset, but this is the general workflow that we'll work within. So as we all know, but it's worth throwing out there, is that all threats are different and we need to be able to quantify our threats so we know what we're defending against, who we're defending against. So some ways in which we can actually quantify the threats that were... Something funky is happening. Let me try. Oh, maybe it's not me. Okay. So some of the ways in which we can quantify threats are by the various capabilities that they have.  And so they'd have to worry about, you know, corporate offices and data centers and stuff being broken into the threat actor that's much more technical and can sit on the other side of the world and attack the same set of assets in a different way. The skill level associated with those capabilities, so you have everything from the script kitties who are just running point-and-click tools to attackers who are able to, you know, do their own fuzzing, do their own exploit research, build their own exploits, and actually deliver on those in a, you know, undetectable or near-undetectable manner. The resources and tooling associated with that, with a given threat actor. So in some cases, considered like organized crime or well-funded nation-state attackers, they may not have the capabilities or the skills in-house, but they have money that they can throw at the problem just like any other business. And, you know, there's a lot of good people that work in the security industry, but there's a lot of bad people in security as a whole, too. You know, much in the same way that a business can throw money at a defensive problem, a threat actor who is well-funded can throw money and, you know, hire people to work on their behalf to go ahead and exploit things. And, of course, the level of access to various components within your system is another big consideration. So if you think about an external attacker who's out on the internet just, you know, doing their thing, interacting with public-facing websites, whatever the case may be, versus an insider threat who may have, you know, domain credentials, they may have a company-issued laptop, they may have, you know, access to internal databases, things like that. They can sit on an internal network, they have badges, all of this stuff that they can use to possibly compromise different sets of data or compromise it in a different way. You know, we need to make sure that as we're designing our systems and placing controls throughout that system to protect our assets, that we consider threats, different types of threats, and these are just some of the ways in which we can do that. So this slide, it's a little bit of an eyesore, and I apologize for that, but this slide covers the threat modeling process at a high level. And so a lot of it is starting with understanding the system structure. So we need to understand what the components that make up our system are, network protocols that fit together or piece those controls, or those components together. Sorry, I'm stumbling. I haven't had enough coffee today, obviously. And so once we understand that system structure, we'll overlay on that system structure assets, controls, identify where threat actors or threat agents live within that system.  And once we understand where everything is, where everything fits together, we'll start to enumerate doomsday scenarios, the business ending events, and canonical attack factors based on the technologies that you're using. So consider a standard web application, a standard banking web application. It's going to have a backend database that has a front-end user-facing application that people are interacting with. It has probably some backend services. It might have another internet-facing service that a mobile app interacts with. And so based on those design patterns, we know that a certain set of attacks can just automatically map to those design patterns. And we can just kind of include those, or we get those automatically. And then we just kind of go and iterate through this second set, and keep looking for different ways in which a threat actor can go through a component or set of components to get to an asset. And so that's the process at a high level. So like I mentioned at the beginning of this talk, we need to make sure that we as people engaging or building a threat model, or designing a system, consider business risk. And so specific to the gaming industry, these are some of the high-level business risks that we frequently see when interacting with clients. So of course you have your account hijacking. That's one of the biggest. You have cheating, service and availability is a big one. But in other games, where there's money tied to an account or money tied to the virtual economy, there's the possibility for fraud much in the same way that there's fraud in our regular economies. And depending on the type of game, piracy and downloadable content might also be an issue. And we'll talk about a little bit later why this is not standard for everyone and why every business needs to consider their own business risk. So one of the interesting things about games and another reason why I chose this particular industry to give this talk, is that not everything needs to be super secure. You don't need high assurance design and controls for every little thing in gaming. And this again maps back to business risk. So some of your assets are definitely worth investing more security in than others. Others are, you have to kind of prioritize what assets are business ending if they were compromised or would cause an enormous amount of revenue loss versus those that are more of a pain in the ass, if you will, if they were to get compromised. And some assets are subject more to monitoring and controlling in a sense than they are just outright preventing them from being compromised. And so this table tries to convey that in some cases, and this is of course specific to a given business or a given title and set of business risks associated with that title, but we've seen this particular table cover a lot of use cases. So cheating, piracy, botting, things like that often fall into the control or allow set of things or control and allow spectrum. And so games like Titanfall, for instance, they don't really do much to prevent you from cheating, but if they detect you cheating, they'll just place you into death matches and stuff with other cheaters.  They will kick you off their servers for good if they catch you cheating. And in some cases, cheating just doesn't really matter in a single-player game. Who cares if you cheat? It's like the games of old on Sega and N64 that did not have internet connectivity.  And then of course you have your assets on the left that are these are the things we need to make sure that we protect. And this is pretty standard for all businesses. So denial of service is never a good thing. Payment information much in the same way that financial services, that it affects financial services or other retailers, never a good thing if that gets out. And user privacy obviously a big issue. So circling back to the threat modeling process, again we need to make sure that when we're building the threat model that we build it off of a valid and accurate system model. And so you can usually build that system model by working with, talking to developers, architects, designers, business owners, people who understand how the system is built, how it was designed, things of that effect. And I'll actually show a very simplified threat model and system model and it might be the next slide and so you do this by analyzing documentation but you cannot rely on documentation. Anyone who's either created documentation at their company or read documentation at their company probably realizes that you go look at the last updated time stamp and it's like 2009 or something and it's grossly out of date. And as soon as you actually start looking at code or talking to people they're like, oh yeah that should change months, years ago. Nothing is like that anymore.  And your diagram should ideally visualize the way in which control flows through components throughout the entire system and the protocols or whatever interaction mechanism that components are using. So that way you can see if a user is passing control over to a front end web application that they're doing that over a secure channel. If it's not an insecure channel then you have a potential and there's assets involved then you have a potential vulnerability that needs to be addressed as an example. Okay, so what's the next slide? So this is a very, very simplified system model and so if you look at from the left to the right we have control passing from the left over to the right and up in the top left corner is everything that's residing on our user's environment. So you have their browser that they use to interact with title websites and payment portals, things like that. Then you have the game client itself which does some state management. It's got some configuration files and then of course physics rendering, logic, all that good stuff. And then the big block in the middle is all of your back end services, your account management stuff, your payment management stuff, monitoring, cheat detection engines, all of that fun stuff that lives in the middle and then you've got your customer service tools or their own game clients that they use in some cases to play the game, interact with the game, monitor language on the title or in chat rooms, things of that effect. And this was taken from, well, this was kind of stripped down from a threat model engagement that we did for a large MMO that any of the gamers in this room I'm sure have played. And so trust boundaries, we had that term pop up in our syntax slide at the beginning. A boundary can be defined, oh, there isn't necessarily a set definition for a boundary because it changes in, you know, you can look at things at different layers. But think about boundaries in terms of when one component passes on control to another component, that would be considered a boundary. Or if you have a network zone, which are these kind of dotted zones around groups of components, that's going to be when a logical grouping of components needs to pass through additional control to get into another zone that contains another block of components. So if I'm crossing over networks and to get access to another, like an internal network, I would need to either route through some kind of load balancer or firewall or VPN or something to that effect. That would be a good place to place a trust zone. So some sample assets. These were specific to, and there was many, many more, but to avoid things becoming a complete eyesore, we stripped it down to these six. So these are some sample assets for this particular MMO that we reviewed. And of course we have the game content itself. This was a paid game with some extra downloadable content that you could purchase. You had your account information, pretty standard. Your billing information for ongoing payments and downloadable content purchases. You had your actual player assets. So players invest so much time into some of these games. And research has shown, actually, that a player account on some of these larger MMO games are more valuable than a single or even a set of credit card records that are stolen and sold on the black market. So for instance, a World of Warcraft account, in some cases, goes for up to $500 on the black market, if compromised. So let's say Blizzard was breached and somebody was able to access 10,000 accounts that were not protected with multi-factor authentication and they were to sell access to those accounts on the black market. That would be a much more valuable hack at a much smaller scale in terms of accounts compromised than some of the big banks and such that get compromised where they have all of these risk management and insurance and all this other stuff to protect them, and ultimately the records end up going for much cheaper. So it's just an interesting spin on how to look at the value associated with a given account. And of course, if an account is compromised, all the assets within that account are compromised. Then you have things that facilitate fraud and cheat detection. So they descriptive metadata that services are collecting and monitoring on. If an attacker was able to tamper with that, that could facilitate cheating. And then you have access to, this is more of that functionality piece, access to customer service representative accounts. So in this particular case, they were using the same version of the game client. They just resided inside the internal network and used their own account to log in. It was a domain account. And the customer service account, all that functionality was bundled inside the same game client. So if somebody was reverse engineering that game client and found a way to unlock or trigger that same set of functionality, they could do things that would facilitate compromise of other assets on this list, such as giving myself more assets, more inventory, more experience points, level ups, free downloadable content, or just spam out or mess with other players' accounts. All in all, just nasty stuff relative to this game. And so getting started, we will overlay, as I mentioned before, overlay assets onto our system model where they end up lying. And then we'll kind of keep a running legend at the bottom. And so you kind of go through various discussions with folks who are developing, maintaining, designing this system and figure out what all of that sensitive information is and just continually add to your threat model. You do the same exact thing with controls. So this is, again, a shortened down list of controls relative to this specific game. And you do the exact same thing with your controls. You overlay that onto your system model. And an interesting tip or useful tip, rather, is by overlaying controls and matching them up with the asset that they're supposed to protect, if you get to the end of the exercise, the end of your interviews and artifact analysis, and you have assets on your system that do not have a control paired up with it, then that may be an easy way to identify a potential design flaw. So for example, with the CDN down here on the bottom left, we found that there was no particular authentication or access controls, anything like that associated with the CDN, and they were doing all of their pushes out to patcher applications or installer applications on a user system over clear text HTTPs, and all of those local apps ran as admin on a user system. So there was an easy way to get administrative remote code execution on user systems if you were able to either compromise the CDN or compromise the traffic if you were on the same network as a user. So the particular threat agents.  You have your malicious user, which many gaming security talks will exclusively focus on. They'll put all of their eggs in this little basket that's on the top left and not really consider anything beyond that. Obviously a big issue, but it's not everything. As you can see, there's much, much more going on relative to how a game is put together. You have your other attackers on the LAN. So external from the internal network and such, but still on the same local network as another player. So that's where, like the CDN updates over clear text would come into play. And then you have the insider threat. So, you know, anybody on that internal corporate network where the game services are hosted that may come into play, be able to sniff traffic, if you have payment information being passed around at HTTP, you know, poor access controls on player payment databases, things of that effect that might be easy wins for either a malicious insider or a compromised insider, because, you know, both are very real possibilities and likely possibilities. So this is a good place to start when considering threat actors relative to your system. But of course, specific to your gaming genre and your business risks, you may have more or less, or, you know, you may need to tweak these. And we'll talk about that in just a little bit. So, you know, again, overlaying on the system model, putting the threat actors where they belong, and from here is where you would start to, where you would start to use, you know, you could use big red lines, you can do each one individually, you know, whatever floats your boat really, but you would draw lines from a threat actor to an asset. And depending on what controls you need to go through, what components you need to interact with, if you find that it's an easy way, that it's easy for a threat to access to an asset, either by circumventing a poorly designed or implemented control, or by not having to go through a control, then that represents and constitutes a design flaw. And something where you should consider putting in defense and depth controls to protect that asset. And so you can iterate through this, you know, to your heart's content, putting in as many attack vectors, brainstorming as many attack vectors as possible to identify all the ways in which your assets are, either are under attack or could be attacked. And again, you could use this same approach on any type of system. It does not have to be a gaming system. So places that it makes sense to do a threat model. So in the beginning stage of a systems development, this is more focused on, you know, generating abuse and use cases that drive software development and system design. On the latter case, when you actually have a fully functional system because, you know, code has been built and things have been implemented and installed on servers, and you can actually go interact with things, that's when, you know, you're going to end up with the more complete model that we saw a couple slides ago. So as I alluded to, different game genres are going to have, the threat model associated with different game genres is going to be very different. You're going to have different threats, you're going to have different assets, and the controls protecting those assets are going to be different. And this is where the business risk comes into play because different revenue models associated with the game are going to drastically impact the threat model. And so, I am a huge fan of Batman as my arm will indicate, but who here is familiar with the, either of these games, the Arkham games or servers, games. Yes. So, for anyone not familiar, the Batman Arkham games is you play as Batman, it's a single player game, there's some leaderboard stuff, but that's not a huge component of it.    Protecting the game's content with, you know, DRM, whatever the case may be, is much more paramount than something that is freely downloadable such as DC Universe Online. So that's one big example. Also, cheating is not an attack vector that you would be concerned about in the Arkham games, because everything is self-contained in that little single player instance, who cares if you can cheat? Who cares if, you know, all that really does is degrade the player experience with regards to, you know, being awesome in the Batman storyline and, you know, working through and, you know, beating all the villains that you have to beat. Whereas cheating in the DC Universe game is much, much more apparent and other players interacting with that world are going to see, you know, that this player over here is cheating, they're getting free inventory, free level ups, whatever the case may be, or they're able to just build a bot easily and, you know, have their player churning through missions or quests or whatever on a 24-7 basis and, you know, they're leveling up a lot faster than anyone and it provides an unfair advantage and so that can decrease the player buy-in and ultimately the revenue associated with the game. Downloadable content is another big one. So that's another way that the Arkham games end up making money after your initial sale as they'll sell you on downloadable contents and new missions, new storylines, things like that. And so they have to worry about how users actually download that content, how it gets how they make authorization decisions to ensure that if that content resides in your system that your player ID is allowed to access it, things of that effect, whereas in the DC Universe game it's not really as big of a deal. I think there's some DLC, but it's not really as big of a deal as it is in the Arkham games. So another thing to consider is that gaming platforms that your game title is going to reside on, and of course this again extends to anything that you could theoretically threat model is going to drastically impact what your threat model looks like. So if you consider things that are in a user's control, so, you know, PCs, mobile devices, web browsers, things of that effect, that's all in the user's control, they can pick it apart, they own their machine, they can do whatever they want to it. There's the common bit of security knowledge that if an attacker has physical control over a system or something that they will be able to own that thing, given enough time and skill and all of that, versus things that are cloud-hosted. So NVIDIA has rolled out this cloud-hosted gaming console service called RID, and basically you interact with a gaming PC through a web browser, and so you don't get access to the underlying PC itself. And so they've attempted to remove the risk associated with, you know, an attacker having access to, you know, the underlying game client and all of that by forcing you to route all of your traffic through a web browser and interact with it that way.  So, again, we can, of course, model all the things in the world, so and then, you know, once you build a threat model on a very granular piece of a much larger system you can fit those things together. So I've been involved in threat models on gaming consoles, on much, much larger MMO games, on mobile games, on mobile devices, all of these crazy things and you do enough of these things and you see enough of the results, you know, security vulnerabilities and just security intelligence post it out in the industry, you can start to piece all of these things together. So you know that if a particular system is using design pattern ABC on technology XYZ, then you're going to end up with, it's a deterministic way to identify potential security issues. But the thing to keep in mind in this is, regardless of how many things you threat model on a much more granular focused basis or, you know, assess whatever your assessment methodology is, threat modeling or otherwise, you still need to step back and consider your system and how your system uses all of these things because there will be some contextual stuff that comes into play. So this is just building, again, on the reusable components throughout game design. So, you know, if you're using, you know, this kind of ties back to the vulnerable libraries discussion, if you're using frameworks or libraries that are inherently insecure, so if you're building a Java application on the old version of Spring Security, then, you know, we know, without a doubt, that you are storing your passwords insecurely because Spring Security will use, I think it's, I think the old version of Spring Security uses just basic salted hashes, versus the new Spring Security, Spring Security 4, that uses Bcrypt by default. So, you know, unless you're doing something custom as a software engineer, which is probably not the case when you're pulling in a framework or using a library, then, you know, we can default to and have easy wins for vulnerability identification. So, one of the biggest challenges that the gaming industry faces, and this is one of the ones that most folks end up focusing on, is running trusted software, supposed to be trusted software, on a busted platform, so i.e. things that the attacker controls, their mobile device, their console, their PC, whatever the case may be. And one of the biggest challenges has been how do we make sure that we run trusted code in an untrusted environment, because ultimately we have to get stuff back into our system. We need to take input from an untrusted source and do something with it. And so, you know, for whatever reason the gaming industry, in some cases does, you know, they do things very well with regards to security, in some cases they don't. There's still an over-reliance on placing trust on the client, because for whatever reason we think that you know, it's difficult to reverse engineer software. As the last talk showed us, there's so much tooling out there there's a lot of people interested and engaged in this stuff that it's really not all that difficult to reverse engineer software in today's day and age. And so, you know, much lower skilled attackers can do more advanced things. Of course, you know, higher skilled attackers can do much cooler things and bypass, you know, white box crypto implementations like ArcSan and Metaphoric things of that effect, but the barrier of entry into these kind of attacks is getting lower based on tooling and research that people are doing. And so, you have to ask yourself as a system designer, what kind of risk do our users present to our game? And what kind of trust do we want to put into those users?  So, you know, if they're hooking network traffic or intercepting network traffic and tampering with it, then, you know, we need to be prepared on our back end web services or whatever we have that's protecting or that's accepting that input. We need to be prepared for that to be malicious and potentially bad input. So, you know, all of the general secure system engineering stuff comes into play here. So, some higher level program considerations. So, obviously, defense in depth is clutch. If we, you know, circle back to again the example threat model diagram, you notice that placing all of your eggs in the in the game client trust basket.  You need to consider your network protocols that go not only from the game client to the back end, but also network protocols and such that are passing network traffic around your internal network. So, defense needs to be everywhere. You can conceivably put defense. And you need to understand how data flows throughout a system and where you can protect that data in certain places throughout your system. Integrating security touch points into an SDLC. Regardless of what your SDLC looks like is clutch. And the earlier that you can end up doing that the better shape you're going to likely end up being in. So, if you're considering things right at the onset of a new title or a new software project and you say, you know, here are all of our use cases. We know exactly how we intend users to interact with our system and we can compliment those use cases with abuse slash misuse cases. So, all of the ways that a nefarious user could potentially use our system and we want to understand how our systems could break based on that set of use cases or anti-use cases rather. Using threat modeling as a means to drive other security activities such as static analysis, pentesting, whatever is a great, great thing to do. So, because threat modeling takes into consideration the overall system as a whole, as opposed to a pentest which is much more focused in many cases or a code review which looks at, you know, a set of libraries or the use of a framework in certain places or just code, not network protocols. We can use threat models to identify clusters of high value assets or clusters of potential vulnerabilities and we can say this area really needs some TLC. You know, we really need to invest more dollars, more activity, more attention over here using this particular assessment methodology or just defensive dollars to throw more technology at it, throw more engineering hours at it to help fix things. We want to understand the overall system as a whole and then zero end is a great, great way to approach things. And then consider again the value of the asset you're trying to protect and what the assets are going to be relative to your particular game. Because, again, that's going to change for every single title, every single system. So if you're protecting a, if you're protecting a banking application versus a, you know, a healthcare application versus a game, those three things are going to look very, very different even if they had a similar type of system design or use similar network protocols, things of that effect. And then the last thing that I want to mention here is that not everything needs to be 100% secure. So nothing is ever going to be 100% secure or else we all wouldn't be at this conference because everything would be perfect. And we know that's not the case, hence we're at the conference, trying to learn more about this stuff to make our industry more secure. So, you know, as security professionals working in this industry we don't want to, you know, it's going to work against us if we run into a business owner's office screaming as if the world is on fire at our organization and claiming that we need to make everything 100% secure from 100% of attackers because that's not the case.  It just doesn't add up. So, you know, you need to make sure that you understand the threat actors relative to your business, to your title, to your revenue model and then secure your assets, your critical assets against those threat actors. And everything needs to be relative. And I want to make sure that I left some time for questions at the end or that we can escape early for beer o'clock. So, any questions?


make you safe and protect you from being, you know, challenged by any privacy regulation which is going to change later on. It's also, you know, something you have to take into account. And last is future proof because the day we can tap into only channel budget, which are mainly guided by TV standout or online standout, you need to have sophisticated data points so that it's as frictionless for you as possible. And we will not require new investment or erasing whatever you will to restore what it is and justify the gaps. So that's how we see first party data.  Because at the end it's all about generating revenues.


I would like to now hand the floor over to our esteemed presenters, Cindy Farley and Jennifer Jagger. They will be interviewing themselves in the interest of time. Thank you, Tanya. Can y'all hear me okay? Yes, we can hear you well. Okay, excellent. I'm Cindy Farley. I'm an associate professor at Georgetown University in the Midwifery and Women's Health Nurse Practitioner Education Programs. I teach labor birth, postpartum and newborn care, and am involved in other professional activities such as organizing and leading advocacy activities with students. And this is the topic we were invited to present to you today. I live in the middle of the United States in the village of Yellow Springs, Ohio. Our students and faculty are located all across the United States. Our education programs have been offered in distance learning format since 2011, with occasional on-campus sessions, at least until COVID restrictions were enacted. My co-presenter, Jennifer Jagger, is located in Oregon on the West Coast and is three time zones away. This is to point out that a lot of work can be done while collaborating at a distance. Whether it is teaching, learning, advocacy, or putting on a conference such as this. Here I am in front of the Capitol in Washington, D.C. with friends and fellow faculty. Our objectives today are to talk to you broadly about the importance of political will and advocacy efforts, and how these elements affect your ability to practice and care for the women and families of your country. We are going to share with you the story of our development of a political advocacy learning activity for our Midwifery and Women's Health Nurse Practitioner students at Georgetown University, located in Washington, D.C., the capital of the United States. So, just to point out, geography was really important in developing this learning activity. This has been very successful with some implementation challenges along the way, and the most recent challenge, of course, has been the global emergency of COVID-19, and how that has touched every aspect of our lives, including clinical care, teaching, learning, and conducting advocacy initiatives. To our live audience, we are curious as to what form of government and regulation is in effect for Midwifery practice in your country. If you could, please share in the chat box where you are from, what government structure is in place, and whether you have participated in any political or advocacy activities and what those activities were. We know that some Midwifery students are drawn to this profession from either witnessing or experiencing social injustice and inequities in childbearing. Advocacy at the policy level and legislative level is one way to begin to address and correct these inequities. The Executive Board of the World Health Organization designated the year 2020 as the year of the nurse and the midwife. This represented the political will of 194 member countries. This is really important. It is a big deal. Their goal with this declaration is to improve health globally by raising the status of nurses and midwives and moving universal health care forward. The World Health Organization is a partner on the development of the State of the World's Nursing 2020 report and the State of the World's Midwifery 2021 report, which are intended to support country level dissemination and policy dialogue around nursing and midwifery. If you'll recall the last State of the World's Midwifery report was released in 2014, so we know there'll be some changes. This is a unique opportunity for nurses, midwives, and colleagues to galvanize our political will and enhance political involvement in our respective countries and localities to make positive change in health care. In particular, midwives are global contributors to safeguarding maternal and infant health, and yet in some areas of the world they face regulatory barriers that restrict the full implementation of their education and expertise. The Year of the Midwife 2020 is a call to action for all those involved in birth care to assure that a well-educated and regulated midwifery workforce is functioning in your country to meet the needs of women and their families. We need to make sure that this designation, Year of the Midwife, does not get lost in the Year of the Plague, the Year of COVID, given all the heroic measures and sacrifices that midwives are making to safeguard the health of their communities around the world. It was pointed out in the pre-conference yesterday that midwives are a best buy for governments. Over 80% of maternal deaths can be prevented by good midwifery care. And remember when we save the mother we've saved the family. This kind of messaging needs to be shared at all levels of government, and a midwife voice in legislative development and decision making is vital. The Year of the Nurse and the Midwife was time to honor the 200th anniversary of the birth of Florence Nightingale. Florence Nightingale is an outstanding role model to consider when encouraging political advocacy. A common barrier to political engagement is the sense that one person can do little to affect change. However, in the words of the Dalai Lama, if you think you are too small to make a difference, try sleeping with a mosquito. This Nightingale was not political per se, but she had the ear of policy leaders, military officials, medical personnel, and statesmen. She communicated her passion to moving nursing and midwifery to respected professions serving the needs of the people. Through determination, persistence, and hard work, Miss Nightingale worked within the existing power structures of the time and was the impetus for reform in healthcare and nursing. She used statistics to guide her decision making long before the term evidence-based care was born. Miss Nightingale established formal nursing and midwifery education in the 1860s in London, which helped to professionalize both disciplines in the eyes of the public around the world. For those engaged with work with childbearing families, Miss Nightingale's story reminds us to use the same advocacy skills for health policy as those we have developed when assisting women to navigate the unfolding conditions of their labor and birth. Three pillars of a quality midwifery workforce include strong midwifery education programs, association development, and regulatory frameworks. Working in concert, these pillars helped to create a cadre of midwifery professionals to be the guardians of normal birth in their respective societies. Educational initiatives are in process across the globe to improve midwifery education. It is essential that political and policy advocacy are part of these curricular changes. Georgetown University, with its geographic location in Washington DC and its history of proactive engagement in federal relations in the United States, is ideally situated to provide powerful experiential learning in social justice through advocacy efforts to their midwifery students. And as you saw in the photo, we take students to Capitol Hill to meet with their legislators. Collaborating with our professional organization, the American College of Nurse Midwives, we determine legislative asks, and students will begin to prepare for scheduled meetings with legislators or their aides. And during this, an intimidating process is demystified and has created graduates who understand how to speak truth to power, positively, persistently, proactively. And I see a couple of our students in the live audience here today. This slide illustrates a healthcare disorder that I call electile dysfunction. This group is signing a bill related to women's reproductive rights, and quite sadly, they are restricting these rights. What is missing in this photo, if you would fill this in in the chat box, please. That's right, not a uterus, vagina, or ovary in sight in all white men. This group does not represent the very people this law will affect. At the 2017 International Confederation of Midwives Conference in Toronto, Canada, the United States was called out for its regressive policies in reproductive counseling, affecting not only citizens of the United States, but some of the U.S. sponsored humanitarian aid efforts around the world. So what we do can affect worldwide care. Women and midwives have been underrepresented for too long. It is time to step up to the table to run for office, to get a seat at the policy table. To paraphrase the song from the play, Hamilton, we want to be in the room where it happens, the room where it happens. At that conference, I was so inspired by an Argentinian midwife who spoke and had recently been elected to their parliament. I would appreciate hearing from our live audience and those who listen to the recording later if they're aware of midwives being elected or appointed to public office, please let us know. This slide also illustrates that law and regulation can become more restrictive. It's not just a forward movement. So it reminds us to be watchful of current initiatives in our respective governments. Regardless of the type of mechanism used, it is important to ensure that the regulation process becomes and continues to be transparent, fair and robust. It should therefore be evaluated in an ongoing manner. This is where a strong member supported midwifery professional association has a key role. And so I encourage all you students now to become student members of your association and to continue that well into your career. This work with your professional organization works with governments to find ways to establish support and monitor legislation affecting midwifery. Just as we speak of social determinants of health, there are also legal determinants of health. Law can be a powerful tool for advancing global health, yet it is underutilized and poorly understood. Working in partnership with others, midwives can become champions for laws to ensure that all women everywhere have access to midwives who can practice to the full extent of their training and expertise. In this way, we can realize the promise of midwifery and making a positive difference in the lives of the women and families we serve. The United States is a patchwork of 50 states, several territories and districts, and each has local and state laws, as well as national laws affecting practice. No wonder we have trouble moving forward as a cohesive country. A recent study showed that where laws are supportive of midwifery practice, that the midwifery workforce is more robust and able to care for more women and therefore optimize health outcomes. We are also aware of areas in the world where midwives are not respected, harassed by local authorities, even jailed for conducting home birth. But I want to call your attention to positive abilities of law to move midwifery forward by giving you just a few examples. Our neighbors to the north, Canada, while traditional midwifery has been practiced in the remote areas there, professional midwives were not legally recognized until the 1990s. Midwifery is now taking hold and flourishing. One of the areas that Canadians are working on are laws that support the education of native and Aboriginal midwives to keep women safe in their remote and very northern home communities, and ending the practice of state-required relocation to urban centers in the last months of pregnancy. This was quite a burden to women who are unfamiliar with urban settings and alone in a city. I would like to call out Brazil as well. It's well known for its very high Caesarean rate. However, there is a movement to counter this and it of course involves midwives. It's called a humanizing birth initiative that has the support of the government, and it began with several designated centers offering a range of supportive labor practices with the intent of reducing Caesarean rates. Through a snowball technique of seminars, workshops, and sharing best practices, these centers are making inroads to change Brazilian culture around giving birth. And the third example I'd like to give you is Indonesia, the host country of the now changed to 2021 International Confederation of Midwives Triennial Conference. And I hope you all will consider joining me there next May. The government of Indonesia realized the value of midwives to their nation's health and put in place initiatives to bring their midwifery education up to the ICM global standards. I personally became aware of this when a book I am co-editor of, Clinical Practice Guidelines for Midwifery and Women's Health, was chosen to be translated into Indonesian. I found that very much an honor and a surprise as well. Luckily, I have a friend who is Indonesian and she could verify that the translation was true to our English version. And finally, even countries where midwifery care is well established and supported by law, such as the United Kingdom, the Netherlands, and New Zealand. All of us need to be watchful that the laws and regulations supporting practice are not eroded. The absence of opportunity for political engagement is a prime reason why more students are not engaged in civic work that involves public policy and government. However, a structured learning experience during midwifery education can inspire the motivation to engage and to act in the policy sphere. Political participation is not a typical focus in basic midwifery education where both students and faculty are focused on the acquisition and practice of knowledge and skills around basic clinical care. However, once new graduates step out into practice, they begin to realize the importance of legislation and regulation on the ability to practice to the full extent of your training and expertise. Midwives, both new and experienced, need to have foundational skills in political advocacy as well as clinical expertise in order to make significant positive change. For midwife educators and clinicians listening in, be sure to create opportunities for students to engage in advocacy work. Doing it together in small groups and making it meaningful. Know that it can be rewarding that you are making a difference for women and families at a systems level. Advocacy efforts. There's another slide. By students, our service learning activity, when we take our students to Capitol Hill, we are making actual contributions to moving forward the legislative agenda of the American College of Nurse Midwives on behalf of midwives in the US. An experiential learning activity provides authentic work toward meaningful goals and engages all the senses. And this has been an important aspect of this learning experience. Part of what I loved about the activity when we were able to go to the Hill. We walked the halls of iconic Washington DC buildings, taking in sights, sounds, smells. And additionally, we had a sense of purpose and heightened emotional engagement. What started out as nerve wracking ended up being quite meaningful and memorable experience. However, COVID-19 has altered our in-person visits for the moment, but remote live meetings can occur via computer or phone. Email and handwritten letters are also available avenues to express ourselves to our legislators at this time. We are also beginning to see some in-person protests. And some are organized to respect social distancing. Some are not. We'll have to keep an eye on these activities. It is important to choose advocacy issues that are congruent with school values. We consider Georgetown's Jesuit values and the American College of Nurse Midwives supported federal legislation. And we choose to focus on just two or three issues related to supporting midwifery education, midwifery workforce growth and maternal and infant health. Simply educating legislators and their staffs on how midwives can help solve some of your nation's health care problems is really the best thing you can do. We usually have appointments ranging from 10 to 30 minutes. And we usually talk to the aides or the interns, but occasionally to the legislator themselves. What we find are that they have varying levels of knowledge and experience. But the main thing we find is that you as a student midwife already know more than they do about the current value of midwifery in your country and how the contributions of midwives to your nation's health can be optimized with some supportive laws and regulations. And remember too, you need to think of this not as a one and done, but rather as beginning an ongoing relationship with your legislators. I will now hand over our talk to Jennifer Jagger, my esteemed colleague and dear friend also of Georgetown University and happy International Day of the Midwife. Wow. Thank you so much, Cindy, for your part of our presentation. You're a hard act to follow. And everyone can hear me. Is that correct? Yes, we can hear you. Okay. Great. Thank you. Don't want to talk too long before confirming that I'm not just talking to myself. So, first of all, I want to just tell you, I'm really excited to be celebrating the International Day of the Midwife and International Year of the Nurse and Midwife with you all today. My name is Jennifer Jagger, as Cindy mentioned, and I am a midwife. I do practice as a midwife in the state of Oregon. And again, as Cindy said, that's on the west coast of the United States. I'm also faculty at Georgetown University with Cindy and all the other amusing Georgetown faculty. I love working with students. I'm also a student. However, I'm a graduate student in health policy here in Oregon. So I have a couple of different hats that I'll be wearing during my presentation. Today is actually a picture of myself as a student. So I'll go a little bit in depth in terms of a conversation just about how I became inspired and what motivates me. But first, I just want to circle back to our request for you to place information in the chat box in case some of you joined us after Cindy made that request. Just please pop into the chat box and let us know where you're from, what type of government you have, and what experiences you may have had with professional advocacy, health policy change, and whether or not COVID has affected your education or midwifery practice in your community or country. So let's see. This slide is a picture of me. As I said, when I was a student at the University of Pennsylvania, we call the midwifery program at the University of Pennsylvania, we call it Penn Midwifery. So I had handmade this sign to hold up at a rally or a speech that was given by then Governor Rendell of Pennsylvania. This was from 13 years ago in 2007. I had come to the nursing school at the University of Pennsylvania to give a speech to make an announcement about a new statewide health policy proposal that his cabinet was making that would expand the role of nurses and advanced practice nurses, including midwives in the state of Pennsylvania, expand their role in delivering health care across the state. So we were excited. He was excited. And I was excited. I was at a student midwifery at the time. And we were encouraged by our faculty to attend this event. And we even had a signmaking party. And then I came with my handmade sign. While Governor Rendell was speaking, I held up my sign and he called out, Oh, hey, I see there are some midwives here. We love midwives. And so, after his speech, my one of my faculty might actually my health policy faculty Don Durene at the University of Pennsylvania, she grabbed me and pulled me up to the front of the room and said, he recognized you go talk to him. And this just speaks to how powerful the relationship between student midwives and faculty or mentor midwives are in inspiring students to become engaged in professional advocacy or health policy work. Student midwives are research shows that young people who are exposed to have experiences or activities in civic engagement or policy work. Politics in general are more likely throughout the rest of their lives to be engaged in to vote to be engaged in politics and policy. The same is true for young midwives. If you connect with students midwives if you connect with midwives when they're early in their careers or in their education program. That is the time when we as young people are young midwives are most ready to be inspired and to be connected with that aspect of our professional responsibilities. So to educators that are listening and students. This is the time to get connected and become inspired. So it happened to me. She Don Durene my faculty member made me talk to him. I ended up getting interviewed by the National Local Public Radio Station and I was on the radio the next day I felt so powerful. And I really made a commitment to stay engaged and stay involved in advocacy work and policy work for the rest of my career and my life and I and I have. So, initiating engagement and then working to sustain your momentum and relationships with policymakers, whether it be at the local level in your hospital or in your professional group, or at the state level at the federal level or international level, make a commitment, initiate that engagement and then kind of map out how you're going to sustain that momentum and those relationships for your career and your lifetime. And don't forget to inspire others, right? We have to keep the loop going. So go back and find a student or find a midwife that you know would be effective or might be interested but just need someone to guide her or him into that policy or advocacy work. In addition to this moment at the University of Pennsylvania, you know, I have worked in the state of Pennsylvania as a student I worked with other midwifery faculty and midwives in Pennsylvania to successfully pass prescriptive authority for nurse midwives in the state of Pennsylvania that happened in 2007 and 2008 and I worked in New York State and Oregon to help pass statewide legislation that was positive for midwives. I've also worked internationally. I was a student in New Zealand for the end of my midwifery program. I worked with midwives there and was really inspired by the history of policy change and reform that happened in New Zealand in the 1990s. Some of you may know that New Zealand had a obstetrical led hospital based maternity care delivery system in the 80s and in the 1990s, driven by women's driven by the women's movement and a push to demedicalize childbirth. They passed a new law that moved midwifery and maternity care moved maternity care out of hospitals into the community and made it a midwife led model and now 93% of birth are cared for by midwife in that country. So it's possible to make big changes, sweeping changes. That law was introduced by the Minister of Health at the time, Helen Clark, who then became the leader in New Zealand later on and midwives can make a difference is what that experience taught me as well. I've worked in India, Honduras, and Guatemala on a variety of different projects with midwives, and I'm really excited to be here with this international audience today. So, in 2015 and 16, Cindy and I started work with Georgetown University to develop the hill day activity, which is a really special experiential learning activity that I'll talk about more and ways next to you. So what do we do, we prepare the students months in advance for this activity. We warn them, and then we try to excite them and remind them that it's a requirement for them, which is critical. We do a lot of pre visit planning, they do asynchronous readings and webcast, and they are empowered to make their own appointments. So they call, which is sometimes the biggest, the hardest thing is to just pick up figure out who you're supposed to contact and figure out how they want to be contacted by fax machine or email by phone, and actually making an appointment, either with your legislator or with one of their staff members if they're not available, so that you can meet with them on the day and the time that that we've asked. And it all all of these visit the hill day activity occurs, while the students are coming from their home communities, which can be as far as away as Alaska Hawaii, coming to Washington DC for part of their clinical education and their academic education. And they are doing this in the morning of one day during this day, this hill day activity. So it's incorporated into their education. On the day of the visit, ACNM and Georgetown faculty do a brief update on legislation that might be important to talk about and really just midwifery 101. How do you talk to legislators about what you do and who you are and why you became a midwife. And then you have a very short visit. It's only 15 minutes. It's making a connection with staffers and legislators and providing written materials. All the work of professional advocacy and health policy activities really occurs post visit, so thanking the legislator or the staffer and reporting connecting with other midwives and lobbyists on issues reflecting and making sure that you come up with a plan for following up with that office and continuing that relationship. Next slide, Cindy. So really, the point is not just to have a meeting, but it's to make meaningful connections, short conversation, maybe an ask committee specific legislation that you want them to co-sponsor, being comfortable and familiar and making that connection and then being ready for follow-up. So ending your interaction with the legislator or staffer or anyone you want to influence with. Thank you. I'm going to send you a follow-up email and I look forward to continuing this relationship with you. I want to be your go-to person when you have questions about maternity care, you have questions about women's health, questions about midwifery and how we can better serve the community that we live in. Call me, email me. I'm your resource. I'm an expert. And that's hard for a student to say and really embrace that idea. I'm an expert, but you are. You know more than they do. And you can always use your mentor or other midwives in your community to follow up if there's something that you don't know the answers to. But sticking your neck out and being a resource for legislators is really important. Next slide. So making meaningful connections with ACNM is the American College of Nurse Midwives. The professional organization in the United States that represents nurse midwives and certified midwives in this country. We have state as well as national organizations that are connected and they have different leaders. It's important to circle back with the midwives at the state level and in your community and let them know what conversations you had with policymakers. Let them know what you asked for and what might be necessary. Engage others in doing this work together. And you can advance to the next slide. So more fun pictures. There's a picture of our friend Cindy Farley out front of Bernard Sanders. Some of you may be familiar with that name. Senator from Vermont, Bernie. Feel the burn. Feel on the burn in that photo. Some students and faculty outside of the Longworth House Office building lots of marble everywhere. And then that's me with the American flag scarf. I'm with two students from Wisconsin. I went with them as their mentor and faculty guide to support them in their conversations with their senators and the representatives that day. Next slide. Oh, you know, actually, I wanted to share a couple of quotes.  So I've just a few quotes of students experiences, right? So I think it's fantastic because I love this activity. But some of these students, they be saying, what are the students think? So a few quotes from students. It was great to be able to educate people about the role of midwives because most legislators don't seem to know exactly what our role is. That's so true. Some of the age of staffers in the office is saying, a midwife has never visited me. I didn't know that they were midwives in this community. What can we do to support you? And that always feels good. Another student said, I felt like that was it. That was way too easy. It made me want to keep doing this because for an hour of my day, I felt like we were truly listened to and that hopefully we made a bit of a difference. This gives me shivers. Another student said, I went with a midwife who is very experienced in advocacy work, which was very useful because she was able to fill in any gaps that I had and took a little bit of the pressure off of me. I think more students should have this opportunity while we are still in learning mode. And I'm excited to share this experience with my peers. That's exactly what you want to hear. And it is true if you can go with someone else, if you can find a buddy, doesn't have to be an experienced person. You can go together and you can take turns communicating your ideas. And that just really takes a lot of the pressure off. And lastly, a student said advocating for your profession is one of the hallmarks of being a midwife and best to learn as a student while you have resources and support. And that just speaks again to the importance of doing this in the youth of our careers as midwives. While we still like in learning mode, we still have things that we can add to our repertoire. All right, next slide. So just briefly, we have expanded in 2018. So this all started 2015, 2016, and then in 2018. In May of 2018, we worked with state and national advocacy leaders to move the hill day activities to a combined hill day and off hill day. So now we have students and midwives around the country that are going to local offices in local districts and states. And at the same time, same day or same week that Georgetown students and faculty and American College of North Midweds staffers are going to Washington DC offices. So it creates more visits and more advocacy efforts. But really the important thing is at home as well as in DC, getting all of the staffers and all of the policymakers engaged and involved with midwifery. And more midwives and more students participating. So in terms of numbers, we have had, as of January of 2020 when we were doing hill day and off the hill day combined, we have 275 students that have participated and 643 visits to legislators. In April, as Cindy referred to, we had 17 students and 12 federal legislators that were met with, excuse me, 12 states. So that times three, which is 36, really good math. So 36 legislative offices and 17 students were visited in April, but that's virtually that that because of COVID, we had to do everything off the hill, but we had experience. We've been doing off the hill for two years. It was easy to transition. We'll have had other university students participate with us, not just Georgetown students always really fun. Next slide. So just two examples of in the US of legislative work, a success, the maternal health accountability act or preventing maternal death act of 2017 was passed in 2018. And that is something that Georgetown students and faculty were able to advocate for during their visit. And then we have a current effort HR 3849, which is the Midwest maximizing optimal maternity services act. And that is a, so the first act was about reporting on maternal mortality to support surveillance systems on maternal morbidities. And that was the two best success. And then this 3849 is to improve maternal outcomes by ensuring access to high quality maternity health services for women, looking at asking federal policy makers to prioritize investment in accredited midwifery education program. So this is for students and educational institutions to expand midwifery in the United States. As some of you may know, we only a part of 9% of a person in the US at this time, but we are looking to grow. We need to do that by training more Midwest and need help funding that. Next slide. So the future is bright. We have women strong powerful women that are in Congress. A fantastic picture of a few of them, women of color and women who are making big asks. And we stand to join legislators that want to promote midwifery as well. So we are going to have a female vice president that running mate to the presumptive Democratic nominee for president Joe Biden here in the United States has promised to choose a woman. So that we'll have more women, hopefully an office that are kicking, you know what. Next slide. And I, I will just sort of put this slide about COVID-19, I think is important that's what we're all dealing with right now. And I, I won't go into a lot of detail, but just to encourage you will, I think I'm running a bit short on time. So I will leave most of this conversation maybe to the discussion in the chat box. You have had experiences, how, how has COVID-19 affected midwifery new community and maybe even your interest in engaging in professional advocacy and health policy change. I think it's highlighted in my community questions about rights for birthing families versus safety of the community and health professionals. And we've been having to ask a lot of new and new questions and also looking again at old questions to make sure that we're both protecting rights and protecting health. And then my, my last slide is some more pictures of students and myself and other midwives from Oregon, midwifery students from California, and then the youth in my household. I've got a one year old daughter and seven year old twins that came with me in May and August last year to go to the Hill with students and with other midwives. And this is it, right? The future is young midwives and young people engaged and feeling like they can make a difference.  The question that I would ask you to ask yourself is what would the policymakers in your community say if they were asked, if they'd heard from any midwives with student midwives on a particular issue that you know impacts the profession or the community that you serve? And if the answer to that question is the policymakers would say, I haven't heard from midwives and midwifery students. I don't know what they need and what they want. Then we have to step up. We have to make relationships. We have to be courteous, reliable and helpful, but we have to be persistent in order to make change. I look forward to working with you all on that. An exciting time. Thank you for your attention. Thank you both Cindy Farley and Jennifer Jagger for amazing presentation. We don't have a lot of time for questions, but maybe we can take one or two. Are there any questions? Both are such strong role models for how to uphold the three pillars of a strong midwifery practice through education, supporting education, regulation and your associations. And I really feel inspired and understand the importance of claiming our political will for maximizing maternal outcomes. It was really important conversation. Thank you so much. Thank you Tanya and thank you Jen and thank you to our audience. The next sessions, here's the references. Excuse me.