What's up everybody? It's Jason here for jasperjasecasebreak.com. It's new release day Streeting today is 2019 upper deck SP authentic hockey. This is a 16 box master case break picker teams number two on our website This filled before number one. We had a handful of teams left in number one. So we put them in a little filler Pack break and we're down to 21. We should be able to get that done today But we're skipping over to number two Yeah, we have plenty of cases to go around so this is pick your team number two guys And we're also giving away an SP authentic box if you buy three or more teams. So By three teams you get one entry into that giveaway you buy six teams you get two entries nine teams three entries Etc. Etc. So we'll alphabetize my customer name to see who has entries into this giveaway and see how many Customers are in that we'll do that at the end of the break Let's just start ripping It's been a while since we had a new new release for hockey Since like credentials and I actually don't even think I broke much credentials Get a lot of RPG Platinum. That's my favorite. That's the authentic another fan favorite Comment country, I have no idea man. I didn't create those. I just think maybe cuz Be a little too pricey for some teams So if you buy the if you buy the same team in all four pick your teams, you're pretty much buying into a case So they get to be in the same price Or we didn't get much that could be the other thing Yeah, so whatever however many boxes are in a case would as a 12. So I assume Pick your teams one two and three are from the same 456 or Senator something like that. So I don't know why we did it that way But as long as you just get them in the in the picture teams, you should be okay Yeah Someone will take that risk and get them like only one of them or you know, if we have to we put them in a team run the number block or Giveaway, etc, etc. But yeah, we made maybe we didn't get much. That's probably why to I Think core Kings is not the most expensive product, but so obviously With this draft class. There's some teams that are pretty pricey Yeah, if you were lucky enough to get them in all four Howard mini-picker teams and you got them All righty guys so good Chase future watch autographs. I know people are gonna say wow. Why are they numbered out of 999, but I mean, it's just the way it is There's also a new product coming out soon, too. It's called stature Which if you really think about it kind of looks like five-star Which would be pretty cool But yeah, we figured why not get all 16 boxes done in the same case Curtis just get it all out instead of half cases Yeah, how about that? Well, but did anybody buy it at 30,000? I doubt it So it'd be crazy to buy it at 30,000. I Honestly think that it should have been like 10k since like the box probably go for five usually first of the line double the price for 30,000. That's that's insane I'll start tomorrow and ain't no one gonna buy that Yeah, no, not for the comic-culture. Yeah, I mean sorry if we don't have it It'll probably see if you shop elsewhere. I'm sure you can get your needs there, but Well, honestly, SP authentic packs are usually easy to rip. It's just these ones are really rough this year I can't even get my Grootman because Have to make sure not to damage the car This is not a good start to SPA. Although the cards always look fire Yeah, I'd be okay with this guy for like 10 12,000 but not 30. I don't know I used to I could fly through SPA Curtis. Trust me. I don't like these packs. These packs are not helping too rough These packs in like a couple years are gonna be really hard to rip Actually, just gonna just fall apart. I think all right. We've got a redemption right off the bat future watch autographs Rudolph Belser's I have to look at that but totally forgot where he plays I haven't seen hockey or heard of hockey in so long I was on the Ragell off side of the times She know what Belser's is auto-centered isn't it? Chase some Young vins as well Adam Johnson and wow, we got a high gloss man. I have the bad These are tough to hit and it's for my Kings. Look at that a high gloss. Who has the Kings in this one? Edward, there you go. These are super rare to get and that the FX spectrum.  And Zachary Winsky sign of the times I was also hearing on some forums that This SPA is delivering more than just two autographs that you're getting like up to three or four in every box That's a good thing. Oh, they still have the bounty What's the bounty about you still get like the numbered gold set is uh What's his name for the devil's the best one still I remember that first year they did that or in a while that's 1617 year Yeah, yeah, I remember the first year they did that in 1617 with me with the Austin Matthews There was three customers that shopped with us when I did hockey land Back in the day That actually got three out of the first 100. It's crazy. Yeah. Yeah, I figured it was auto That's what I remember now and I'm really not digging this past man It just they're just so rough how to make it easier on that man when it's It's a heavy-based product like this. I don't want to fly through these packs Open up all 16. You see in front of me Gabe. Oh, we had a Zachary Winsky Ragelaw Velcro redemption and then the high gloss. Oh That you yeah, that is you huh? We're done Hey, you got a high gloss. I mean not that I'm interested. That's John. I only really collect certain Kingslayer Don't really go all crazy Just Kopey can be and next year will be gave her a lardy Oh, let's go this way just because I feel like the autographs might have been on the first box Adam Warner future watch spectrum Coolman, and then this is a level one Drew Dowdy FX spectrum Spectrum cars look really good this year actually. We've got a patch autograph coming up already very nice Adam Brooks usually one per inner and Giovanni Smith tonight 99 future watch for the Red Wings Steve and We got Caden Fulcher Auto patch 41 out of 100 it's a future watch patch autograph for the Detroit Red Wings Going to Steve very nice. All right. Next box guys future watch level two Elias Ketterson. Here's a future watch China and we got Belcher future watch For the San Jose sharks going to Michael And we got son of the time rookies to 99 Carson Coltman For the Bruins going to Edward as well and young guns of Igor Yeah, it's just two autographs, but I think I've been I heard a lot of people today saying that There's up to like four sometimes Like our first box had three and then I think you're still guaranteed like one future watch or patch auto in every case, so We hit one in the first inner so now we've got to do the second one Yeah, yeah, definitely Trevor Moore spectrum level one future watch and you got John Tavares spectrum Leaves going to Tony Adam Johnson young gun and for the ducks future watch. I think this is an update Mark Jones or no, sorry, maybe it's just a retro update or something max Jones ducks one of my goalie and Victor also To 999, I'll be one of the sabers this be essential Adam Warner young guns Matthew Barzell Exclusives to 100 So Bias Jormfront future watch level one So that's Nick off and Kirby Dutch man. There's a lot of redemptions in this rock It's gonna go to the Chicago block house Adam Brooks and Patrick with that one Kirby Dutch Jack Hughes authentic winners and McKenzie For the blues in 999 Uh charismatic no veteran commonship No vets all the inserts and I think they still call these pink So just inserts and the pinks and stuff. Yeah, it's not nice. That's pretty nice this year Oh, yeah, these packs are so rough to rip this year. It's crazy. Can you actually Yeah Yeah, but I forget there's not really that many cards. So it's actually not that bad. It's not like OPC So excessive yeah Yeah, so Joe be ripping some boxes as well. Yeah new product I'll take the five-star treatment I just love that these these companies like just come up with the same thing, but let's just change the name Big star I know they're like too rough I'm telling you like in a couple years when they start like drying out or something. They're gonna be they're gonna fall apart They feel like those kind of time. Yeah Usually they're easy to rip. That's how it looks. I'm gonna fly through this, but They just make sure that cars on the damage Yeah, well a couple of them have been redemptions that are good players But yeah, they look more loaded this year too. I feel like there's more than just two autographs now like you get three almost most What's the What's the story on NHL coming back? I think they already proved it. I just don't remember what the day was. Yeah, I think they approved it in 2014 That's like a like and have like the point. Yeah the 2014 little playoff kind of like a little tournament Yeah, yeah, they're figuring out whether it's gonna be like either sitting in Canada or sitting here in LA or Florida whatever they decide. I know basketball is like official now Yeah 12 more regular season games and then Yeah, I don't know if I would want to see NBA do that like do like a tournament. They just need to figure out the seedings Is everyone gonna Everyone gonna play. I know Damon Liller was just like I'm not really Yeah, he's like if we're not in the playoffs, I'm not playing we're like well That's why I think they had to do it this way and give everybody a shot. So yeah, so he right So that way everybody's like, all right, because it's true. It's like, why am I gonna play for her? Like I'm not even gonna play and make it plus Yeah, looking like you're starting August. I know that I heard that NHL is just gonna run right through no training camp early Like they're just gonna they're gonna dive right into the season Which they kind of usually do if you think about it They're usually playing to like the middle of june They pretty much get just all of july off and then all of a sudden they're back in again on august start training. So it's like It's really not that bad of a difference And since a lot of these teams haven't played since like april it's kind of like them just having a normal off season But the other teams though, obviously they're gonna be playing like crazy But you have had like two months off. So your body should be rested. This is gonna mess up all the seasons for next year too Yeah, are they gonna start a shortened season? I mean, I could do that too cody glass. That's nice to 999 vegas When a david hey, what's up david? Well, you got some nights Yeah, yeah, I mean I mean you just think about it. You've had a normal season really a normal off season being off these last two months So this shouldn't really be no No problem I think if anything what they're gonna do is if they jump right into the season They may just have like no back to back for a while, you know And kind of spread out the games and maybe extend the season like Maybe extend the season like, you know An extra couple weeks just so that way You have I think I heard them say they want to have two like weekends or two weeks of just no Of just like bi weeks put it that way Per team. So that can be another thing too. Everybody should be up and ready to go. So All right, nice about guys authentic moments from in you see And a future watch autograph of Igor For the Rangers and a redemption if you do watch rookie autographs of tarot That's gonna go to the charred wings And again a lot of redemptions guys so far I guess these guys couldn't sign Nick I did contenders number four if you're in number three and it sold out it should be after this I think the only other break that sold out after this was just revolution basketball So It should be within the next hour or so Those breaks are all pretty quick. So Yeah, I know which kind of sucks, but I mean it is what it is, right? All right, so Detroit getting that one Steve. Good break for Detroit so far Yeah, what's up Sean, what's going on man? JC Youngham Tomashoff future walks at the Kane FX spectrum Igor level two Jacob Truba sign of the times rangers Went away and Trevor Morse in 999. I haven't gotten any inscriptions yet Yeah, I wanted to come on a little earlier to try to get like some of these hockey ones out of the way Sean because it'll kill like an hour But it filled like maybe 20 minutes before He got here. So at least that way more More time for other breaks, but I think I think a couple of the breaks like cellos that have sold on stuff. I don't think that came today. So I think that's why Nick also put like Wednesday Thursday. So and then a lot of the rug a lot of the actual breaks in the workshop out of pre-orders For like Friday. I think the only other big break is probably like the baseball mixer, but that should just be fun anyway. So How'd the other mixer go? That's probably yesterday. Was it good? Uh the four case mixer? Yeah, it was awesome actually. Yeah. Yeah I just have to recap video. It's worth a it's worth a look. It's got a Zion autograph. Oh nice. So that's nice from Prism Uh, yeah. Yeah, the hobby, right? Yeah. Yeah, yeah, yeah. Prism hobby No silver drama, right? No silver zions, but yeah, yeah, but that autograph put a lot of base. Yeah. Oh, that's good That still helps base and a few base for the grizzlies Uh lupodontic Trey young dual autograph out of the 1819 immaculate. Oh, we pull one of those again. Yeah, those are cool Atlanta wonder randomizer. That's tough We had a lot of Chance moats. Wow. Who's been on a heater? He uh, he hit that purple disco The other day He was trying to buy it off of Dallas Oh, really? Dallas Dallas madrick said, you know what? I'm a little bit of a gambler. I just want to let the randomizer roll. Oh, man It's brutal. It was tough. Yeah Um, who had who had like the pelicans? I forget who ended up with the pelicans verbal gamblers Yeah, could you just be like you're out of the cell but then you know, you might have won the randomizer Right. I don't even have to sell them Oh, I guess that's what it is I appreciated that uh, that gamble though. Yeah, I know right?  Yeah Because one day you're gonna be on the correct side of that randomizer. Exactly Young guns for the kings. I'm a shop level one FX future watch spectrum I have no idea Wade. I mean, we have like 20 20 orders to go through or something Not too much. I went through all of them pretty much, but I think uh Yeah, we're still at 21. Let's just don't go off today. I don't think it's not But number three might fill before number one. That's the thing Looks like number three is down to one loss. So Rosen This is an update. I think this is last year's future watcher. Actually, no, this is 1718. I think yeah, there you go Update there for the Leafs This patch autograph her ready keeper Number to 100 Florida Panthers It's going to michael Like the flagship product for upper deck, right? Yeah, I mean it's funny because like You would think that like an autograph out of 999 is not gonna sell off But it's like they sell really good because this is like an old brand. Yeah. Yeah. Yeah, they do like golfers and basketball and those core It's real like they're sign of the times are the ones that are really nice Get like all the eight-way autos and stuff mcdavis Dylan larkin ripson Rock best sir Yeah McCarr future watch to 999 Who has avalanche? Jeremy with the abs in number two There you go You spoke a little too soon Wade And no adoption to 999 For the islanders Ready to get chug. All right charismatic. I'll try that. We'll try it with you say it again right now when I bring over the next box Aside from the hits, what are you setting aside? I'm just doing all the veteran boots So it's kind of like this. It's like a series two pattern So it's pretty it's kind of simple. It's not that hard But like sleeving is like yeah, just the autographs autographs and then like the Yeah, the autographs for sure and then the spectrum cards. Yeah, the ones that are like this Okay, got you and then you also I'll end it right. Yeah, there's those three things pretty much Yeah, I think I'll come back and I'll help you with number three Before I go on. Oh, this is two. Yeah, well number one did number one. We put it in a pack bridge So Went right to two. Yeah, someone bought the canuffs like in two and three or some of the bigger teams and then You know that dobson There's boundaries no problem man, and this is like there's one shady. You'll notice a bit. Okay. I'll go through the base again But it's like a pink You'll notice like on the back too That's the only other one that like each time They call it like a pink even though it doesn't look pink. Oh nice. We got our first uh inscriptions There you go, katyn Two out of 999 so the first I think 50 right the first 50 that they number I don't remember that they're inscribed of their of their debut. So it kind of makes it more valuable So he made his debut just this past season. I think Edward you should do that more like just yeah, it's fun right in fact. I think that's a lot of fun What's the rhino? We'll be like, yeah, that's the first 50 people have like a special inscription Yeah, it's just something as simple as like the debut data. No. Yeah, it's true Yeah, the debut one sometimes goes for a lot Jake wallman Jen gone See the curvy to that nine o'clock Instead of like six the last couple days Santa Monica says it's six. Oh, does that sound six? Some cities earlier, but I had no issues last night. Yeah, I mean Although there's a lot of cops water cops. Yeah For sure. Hi Show my essential my essential uh paper Employee Yeah, we have more cases. So once we get through these first three, which we will today I'm sure they will post up more We have we have a couple more cases Maybe I have enough maybe for like another four pick your team to 999 for the auto center's future walk and sign of the times dirt Probably in about 30 40 minutes Jalen The only other break that sold out before I started this was revolution. So Joe would do that first And then he'll go through some orders to see who sold out contenders and then I'm sure contenders will be the third break It'll be up. It'll be coming up soon Yaka, um, I don't remember Jalen to be honest I just remember that last box we did was like a crazy box It had like two cracked ice although there were sticker players, but I have two cracked eyes the DK Metcalf redemption for like a variation And then it had like a one-on-one printing plate autograph. It was crazy Like for a box that you know a lot of color put it that way But yeah, the video should be uploaded, but yeah, it's it's I don't remember if there was any bills to be honest Wow, this is this is the product where you can get so many blanks in God Adam I don't I'm gonna see what you're talking about. Oh, that's a good question. I have no idea Nick just titled it prism basketball so That's a good question. I have no idea if they're blaster or not. I'm assuming they're blaster like you are just because they're 10 boxes but We can confirm my neck soon Because unless that's hobby, that's a great price probably For which way for these ones I'm thinking that's quite blaster. I was like, oh, I'll probably have 20 box breaks Yeah, does it say in in the description? I looked at it right now. I don't think it doesn't say I don't think so I mean, maybe it's hobby who knows But yeah, it's probably blaster. So I'm assuming If it's 10 and 10, yeah, because I think there's 20 in a blaster case All right guys, I should be doing this right now in about like five 10 minutes and then Joe come in. Oh, David Ayers. Wow. They did to make his young gun. That's awesome Do you remember the guy that came in for the canes? They actually made his young gun Oh, nice I wonder what these are gonna go for Yeah, Bama. I don't know if we have mosaic here today the Celepax That's why Nick put in the description Tuesday or Thursday Wednesday Thursday So it's gonna be one or the other if they didn't come in today, it'll go tomorrow 50 bucks for this guy. That's awesome. Man I don't even think I would sell for $50 if I was a young gun It's like the oldest young gun in there and bill ranford. What a great goalie coach There you go Oiler's going to Kathy Brady Keeper All right, last three boxes are over here guys. All right guys. Good luck. See if we can get a At least one of the Hughes brothers Oh, yeah, I said I brought it for us. Oh Yeah, get one while you can, you know, just definitely gotta save it Well coffee and Crispy cream donuts today guys It's a good day Barrett Hayton To $9.99. I was actually waiting in line and then I was like realizing the ordering in the mobile app was much quicker Clim Colston to $9.99 Benstrom Jacob Mark Stone Tristan Jari Anthony Manta Another redemption. Let's put that over there Oh another uh future watch Inscription Ainola to $9.99 for the Jets Going to Steve And another David Ayres young gun.  Yeah, that's the future watch inscription their debut CD Philip Zadina very nice There you go another one for Detroit And this is Detroit Yeah, Colby. I think we're all excited for corkings. I probably won't be breaking. I'm not here on friday And we'll see if there's some still on sunday, but yeah, corkings is always a fun product I think Joe will have a lot of fun with that Yeah, I'm confused right there for a second. Sometimes they do have the Initials of the player, but that one wasn't Haishkonen Roup future icons Son of the times William Carlson If you guys have been keeping up as well too with the economy David RPA, I think it's still at $50,000 But I think two weeks left three weeks left It's gonna be very interesting You're the highest bidder for that right now. Damn is Landers crazy Yeah Curtis, uh, there was a lot of looting around us and protesting So we wanted to be safe. So we took a lot of inventory and stuck it out In a very safe location. So We wiped off the website and just kept it really tiny and we're gonna update some more today To 399 future watch joey the core Joe Povelski wait Yeah, we're just trying to be safe for cautious. I was gonna put up a little Thing We'll put it all back up again soon if not today tomorrow Think once all this stuff comes down It should be back to normal But um, we'll see how today goes.  So here you go Let's quickly show you a lot of these hits that came out Again, so this is pyt number two Number three. I think sold out or is about to sell out. So we might skip over number one So stay tuned guys, but I think all three will sell out today Good deal though for um Pyt c number one you can win a almost $200 team for As low as 20 bucks, which is not a bad deal guys But this this future watch this year looks very very sharp. I do like it a lot And hopefully in the next case we get some some bigger patch autographs, but Pretty solid stuff though Troy Phillips adena bill ranford another david airs kale Patch autograph and we did get a high gloss though. It's pretty cool for my kings right there So there you go guys now. Let's give away some We're not some money actually let's give away spa box Let's do it guys So again, you got out how to buy three or more teams All right, three or more teams Uh, it's not technically sold out man. If you look right next to it that a lord break is going to hold the last six teams So current as you had one spot david only had one edward. You had three So you'll get one entry Jeff with one jerry one kathy one matt bugger with one michael with two michael velucci one two three So you have one entry It's three teams. Yeah three teams. Wow mixing it up, huh? I know right patrick Steve one two three four five six Oh gotta read those added descriptions You know and wade tony was one wade one two three four five six seven Oh, could have gave you one more But you get three of them at least though. Wait, so three gets you one. Oh wait, sorry Six gets you two six gets you two. That's right Wait, you'll get one two three. Yeah, you'll get two entries Not always So there you go small list guys Yeah, steve had six spots right one two three five six All right, good luck guys customer number one gets a free box of spa After two and a five seven times one two three four five six seven After seven times There you go wait box of spa coming your way. I know you had some big teams in here as well No conducts coming out. So I think that kind of makes up for it There you go guys jasmizcasebreaks.com Coming up next I believe is revolution, but Joe will do his intro and all that and then do some more breaks for you guys Appreciate it


All right everybody, welcome back to yet another OpenShift Commons briefing. Today we're going to talk about building trust-based authentication with a whole bunch of Open Source projects, Spires, Bithy, NSM, OPA, and two OpenShift Commons members, Frederick Coutts from ..ai and Bobby Samuel from Anthem AI are going to walk us through some really interesting content here and maybe lay out what all of those wonderful Open Source projects are that they used to make this happen at Anthem and other places. So I'm going to let Frederick and Bobby introduce themselves, take it away, talk for probably 30, 40 minutes, depends on how much content they have, and then give us some time for a conversation at the end. So Frederick, take it away. All right, Frederick, do you mind if I'll start? Sure, I think it's good, you first. All right, thanks. So good morning, everybody, and thanks for taking time to join with us today. I hope we had a lovely Memorial Day weekend and Frederick and I are going to tag team here. So what I'll do is let me set up the business context into sort of the why. Why did we start this? Why are we on this journey and why is it important to all of us as well as to people that, you know, carry insurance and people that work in this space? Why is this important? So let me set that up and then Frederick will walk into some of the technologies that we're working on. So Frederick, if you could hop to that first slide, I will also set us up. So I don't know where your eyes go when you look at this slide, but I was here at Anthem and I only see just three words on here, 2015 data breach. That's, I lived through that here at Anthem and it was not a great time. And so Anthem, since that time, and some of you saw it in the news, it was over 25 million, you can go search on your favorite search engine. It's 25 million or so members had their private help and information taken and taken out and we're still facing the repercussions from that. And so as a result, Anthem's reaction was to beef up traditional security and to put those traditional security in place at one point in time. I believe it was a little over seven hops to get through our firewall to get to an external website. And so we took a traditional model and we bolstered that or galvanize it even more. And as we've looked at that, it's not sustainable long term. And we're taking a second look at this. So health care itself is just the cost of health care. Those of you, actually, many of you that are in the US, US health care spend is about 18 percent of our gross domestic product. It's a huge amount to give you an idea of how that this compares to other Western countries, European health care costs are about 9 percent. So stark, stark differences in how much the US is spending on health care. And so what we've done is we've we've bolstered up our health care. We've seen both of our security. We've seen health care cost rising and we know that the model today that we have is likely not sustainable for, you know, the generations to come. And so as we look at this, we've been partnering with many open source open source partners. So everyone from Spiffy to Spiffy to Spire, if you saw the last CNCF presentation, we were talking about it there. We're also in our world, we're using OPA, NSM and then key cloak to to bring together a zero trust environment and ecosystem. The the why is really driven around. We believe health care and the cost of health care shouldn't continue to rise. We believe that the the data should be should be should be shared and should be in places where it doesn't take, you know, entire teams of hundreds and hundreds of people watching firewalls and watching security protocols to make sure that our our data is secure, that our transactions are have integrity to them. So what we've done is we've started to work with various groups and among this group. And what we'd like to do is we're we're working with cloud native engineers, developers, and I know you don't most people don't think of Anthem as a place where technology is happening. So what better place to do it? So we've we've collected, we've gathered. So Frederick and many other folks that are on Frederick's team as well as my team, we've all gathered with the with the fundamental belief that we can shift the way that we do security, which then fundamentally shifts the way that we do and we conduct our business for the better of the people. So with that, this is this is our approach. This is what we're doing to set up a new way of doing doing business. And we believe that it's not just for our industry, but for several industries that are already working this direction that we're just partnering and moving along with them. We want to be not just at the forefront, but we want to be part of the change that's happening. So with that, Frederick, I'll I'll turn it over to you and I'll be available for questions as we walk through this. Right. So let's go ahead and get started. So let's get started with with a recap on some of some history. So in order to really understand zero trust, we have to look at where we're coming from and most security postures historically focus primarily on what we call parameter defense. Yeah, something that's untrusted that that goes through some security thing off in the firewall into some trusted environment. And so very often it would look something like this where maybe you have the Internet, you have some DMZ with some where you have your application gateway and then another firewall again to your corporate network. And this also goes in the opposite direction. Maybe you want to connect from your corporate network to your Internet. You have these multiple hops that you end up going through. And the connections from the Internet and the corporate network and back are implicitly denied. You have to go through the through the firewalls. There's a variation on this.  So a little bit easier to set up a little bit less. I'm not going to say it's less secure, but if you have less places where you can defend but also still perimeter defense, we also have this in Kubernetes. And so when you connect in with client, you have some ingress controller that then ford you into your pods. So once you're in the into the pod network, then there are ingress and ingress controllers you can put on which help tie it down. But you're still very much in a in a perimeter defense model. Multisite, then another another variation. We have a trusted a trusted network and another trusted network. And we have nodes in one side and services on the other that the nodes want to connect to. So you can see this building on the previous set of defenses that we have. And so, however, the details matter. And the reason I'm getting into the details is because it in order to produce a good security posture, a good security paradigm, it's not just locking everything down because you can lock down things very, very easily. The problem is that you have to be able to lock them down while still providing your service and have the capability to scale that across a large number of systems. So you're focusing on a single computer. Yeah, you can do a lot of things, lock it down, eye touch and techniques and so on. But when you're starting to say, hey, we have an entire company that we need to lock down, or maybe you're working with Fortune 500s and a lot of Red Hat customers can appreciate this where you have thousands, tens of thousands, 100,000 systems, then these details, these security system has to work in such a way that it integrates with such a system. And so in this scenario, and going back to this example, we have two trusted networks. There's a public set of IPs, some private set of IPs. And a very common thing is to say, hey, let's go ahead and allow outbound from this network over to the set of IP addresses and allow from this IP address to these particular services. And so we have some form of a network admonization that's going on here. And so a few questions then start to pop up, like what if I want a differentiate between node one and node two? I'm turning them all into one address in here when I do my network admonization or what if I want to connect to more than multiple services in here, which is a little bit of an easier use case, but it's still something that discoverability is still important. On the server side, you also have questions like how do you trust a client and how do you expose your services out to others and how do you differentiate between node one and node two if it matters? And there's also a whole other set of questions about how do you populate and rotate your certificates over time in the ways that these nodes over here are able to connect in when you start to bring in encryption. And one potential answer to some of these questions is, well, let's go ahead and bring the VPN in. And so what we'll do is we'll say this entire trusted network and the one I 216A10 will trust and connect to this and vice versa.  And when you start adding in third one, you end up with this mesh type thing. You can sometimes reduce down and let's go down to a spoken hub model. But from a mental perspective, this is what people tend to think of. A little bit of an aside. So we're going to deal primarily with layer three VPNs and why layer three rather than layer two. It all comes down to scalability. I'll publish these slides earlier. I don't want to go too much into this but basically layer two tunnels are difficult to scale. Layer three is built on IP addresses which is designed to scale and we use that to scale the internet. But let's talk about scaling subnets. So when we look at scaling subnets, when you have two networks, you're looking at one possible connection through networks three, for networks you're looking at six connections or six subnets you end up having to de-conflict. And so over time, what you have to do is you have to make sure that these all these subnets that you're hooking up to each other and use private networks, either you've de-conflicted them or you're producing some form of net network address translation in a very careful way in order to make sure that they don't conflict with each other. So this becomes a very global problem very quickly. And so in terms of handling the conflict you end up with very careful planning but maybe you've done a lot of planning and maybe you didn't expect the type of growth you were getting or maybe you brought on a new partner or new customer who has a larger network than you were expecting or has requirements that they conflict with you. What happens when things begin to break? You end up bringing in your firewall experts, things like checkpoints or Cisco firewall or so on and you end up building up an IT army in order to start handling all of these edge parameters and handling all of the network access control list. And so maintaining that list becomes very expensive very quickly. So back to the original question then how does all of this stuff that I describe end up improving your security because you end up with a lot of complexity? You end up with fragile configurations and you also have entire sections around observability and debugging in terms of how do you deal with that? And also we're still dealing with the assumption that the attack vector is coming from the outside and I would say out of the entire set of slides that's the most important line right there. So in other words we are defending our infrastructure with 11th century technologies. What if the attack comes from in here? So back to perimeter defense. This is the world that many of us currently live in and what we are pushing towards is a zero trust environment and I'll leave it here for a brief moment. So what we're doing is we're saying the network is untrusted it is no longer the core trusted thing that you have and when you stop trusting the network that means you have to shift the trust somewhere else and so where we are shifting this trust is to the workloads themselves where you're saying we can secure the workloads and we can then develop secure connections between the workloads. Now to be clear just because I say that this network is untrusted does not mean that it is not private it could still be private you still have layers of defense that you're building around but if someone were to breach your network you have other things to mitigate and the secure connection could still be a VPN but you're not relying on the security of that VPN for the majority of your security and so when it comes to untrusted networks please don't think that I'm saying everything has to be public although if you want a really good business test as to how well you're doing you can play this as a thought experiment what if I take my network and make it fully routable on the internet like will I be able to sleep at night and if the answer is yes then that means you're probably doing it right with ZeroTrust maybe you're doing it right so and so the idea is that if your attacker gets in here then they're not able to connect to other things simply by being a member of that network so the question then becomes how do we achieve this so we'll start with establishing a trust domain we will attest the workloads we will establish policy between the workloads and we will also show an example with establishing trust between organizations so the trust domains we're going to use the examples from Spiffy Inspire they're both CNCF projects and Spiffy is a specification on how to on how to get work identity to workloads and how to rotate that identity that the certificates that they're assigned and do so in a hierarchical manner so we start with the CA which is based on the X519 infrastructure and what we'll do is we attest the applications underneath of them and of course there may be multiple layers in here you might attest a sub organization which then attest a cluster which then attest your application gateway but the mental model think of it like this you have attested a workload from some common route and then once we've established that identity and they've received X519 certificates on each one we can then create policy so this policy is a this is a modified example from Open Policy Agent and so the important things in this scenario is where is the is the we we consume the X519 certificate from OPA itself and they they call them SIDs we can we can consume the SID the identity from it and so once we have the identity in here we can check is this ID equal to this and so we say in the storage API OPA would be sitting somewhere here or your proxy right outside of it is it receiving a request from this workload here so if it receives something that does not have this identity in a certificate then it will it will reject that so once you have that policy set up then what we can do is we can is we can have a second organization that follows the same set of patterns and they attest each other and if we want if we want to trust to work those together what we do is we trust the two organizations at the top the two routes trust each other and say I I or one says I trust org to will attest properly and vice versa and you also scope it down to their their domains and so this means that when the front end app when the front end app server tries to connect to the storage API it knows exactly who it's connecting to and vice versa knows where the connection is coming from using mutual TLS which is available in TLS 1.3 and there's libraries to make this easy as well and you can also use envoy to listings that are not aware of these types of concepts and then from the policy perspective what we're doing is we're saying allow connections to and we're setting a destination will match on the destination of where it's connecting to and this site says allow connections from and we specify the source destination from where it's coming from so this will allow those connections to persist and to run whatever set of an HTTP verbs that that you allow it to do and so let's drive this down a little bit deeper though so when you're connecting to organizations together you cannot assume that the underlying network exists and so you have in this scenario we have a character named Sarah who's trying to connect to your secure corporate internet using her application so just because you have the policy set up and the networks and your your identities are set up doesn't necessarily mean you have a path to actually connect so you're so you talk to your ops people and the ops people say well in order to connect we really need a firewall an intrusion detection system and then this VPN so so in that scenario you have to think well how do I actually go about doing all of this all this stuff and so what we're pushing towards is in the network service message we're saying well let's separate out the data plane which is the things that that Sarah wants for her application and let's put a northbound control plane over this over these elements and so you can think of this similar to to an SDN in some ways the primary difference with an NSM is that it's it's more like an SDM for SDNs it'll talk to your two Kubernetes and it'll talk to your checkpoint firewall or whatever you're using talk talk to your intrusion detection system and talk with your VPN endpoint and make sure that it passes information in and out but I won't go too deep into that I have a lot of other material that that I can point you all towards for the internals as to how that happens just the important part is think of it as a control plane and a data plane and when these connect with each other and communicate with each other then that allows us to configure the things within the data plane so what we do is we actually give each of these an identity so your firewall intrusion detection system VPN they all get specific X519 identities and so this allows us to know that when the pod is is negotiating with the firewall it knows that it is talking to the firewall using a zero trust model and simultaneously drill the chain so this allows us to build once we have this identity that actually allows us to build policy we can say this pod is only allowed to talk to this firewall this fire was only allowed to talk to the pod and the intrusion detection system and vice versa all the way up until whatever is terminating that that connection for you so it allows us to build paths through that that that translate into your into your data plane using spiffy and opa has those as those things so in essence we want something that looks like this we want Sarah's app it gets wrapped into some vpn gateway goes over some clouds some internet to your vpn concentrate or to the other side in your api and so pushing those up the same concept as we've had in the application side we have the same set of attestations on each side that occur and we have the trust that is put on the top opa implements policies at each of the relevant locations and a side effect of this is that there's no more application specific network access control list in this in the way that you traditionally do it so this one because we're saying this this application is allowed through some path to communicate with this api using open policy agent and vice versa so we've actually lifted that into something that is more declarative something that's human readable that does not allow that does not require you to put down and this is the IP address of the api server this is the this is the IP address of where the vpn gateway is coming from because right now we're relying on cryptographic identity to do that rather than rather than IP so one important detail to unify this is that these identities are can be cross cutting we can say this identity is the same one that is used by your app which is used by your service mesh which is used by your pod infrastructure Kubernetes and eventually we'll get it down to the hardware tpm so that we can say this hardware tpm has came this hardware came from location that you have authorized that you've that you have yourself deployed so even if a rogue hardware comes in and managed to replicate your stack even if it managed to gain access to some of your identity infrastructure the fact that it doesn't have the right hardware tpm means that it would not be able to to fulfill the attestation when what it asks for what its identity is and so we also have identity in the infrastructure and the other side has it's a set of identity as well so we have this cross cutting identity for each of these and so when we put it all together we have the status quo which is the internet you have some client connecting in and connecting into your application database I apologize like this is a slightly different this is a slightly different use case from what we were showing before the previous one showed it being in a private network I wanted to show off one more one more use case so as we put it together we have a client goes into connects into your your firewall or so on application to your database and so the question that I would like to ask people in a scenario to ask yourself is if you have an attacker here how much access does this attacker have and there's been a number of very high profile breakins where the attacker got in through Jakarta struts or other similar systems that were unpatched or even worse zero days once they got in here they're able to do scans on the network and connect to the database or even connect to a database that it already had a connection to and start just asking queries that that are above and beyond what it should have been asking for and when we start driving this towards towards a zero trust model and the one one modification we can make as we could say well we have a client that we don't really know on the outside but we trust that if the user has logged in properly they'll have a JWT ID that is that is cryptographic so when we pass it in through the firewall to the application server this application server already has a zero trust chain between your application server your database server and database and so we're already saying that the source and destinations for each of these are have been established properly and so that limits the the ability for this attacker to connect to some random database that's on the outside and it's in the outside of this chain and then we've conferred the scope it down and say well we have a cryptographic token that comes from from the client and let's pass that in from we receive it on the application server or we've tested it at the in the inbound API server before it hits the the application server and so what if we were to pass that on to the to the database servers or to your database proxy and say well in order to unlock this API right here this database server it not only has to come from app server but must have a valid JWT ID that we can then check does this ID here in the HTTP request path actually match what is in the JWT ID but do this not at the edge of your infrastructure coming in but actually do it further down and every time it passes to your infrastructure it'll check this is JWT match is this JWT match and so this means that you have that you have two conditions that you have to pass you have to pass where is it coming from application server in this scenario and who authorized this request well the client did from a client who was authenticated and an important aspect of that is that means your violations and policy if you have a violation and policy that usually means one of two things either you have an active attack going on or you have a programmer who made a mistake that is causing your violation a violation in the policy either scenario you have to get somebody to look at it and to and to do with the problem so where does that JWT come from in in the open source in the open source path we bring it in using something like key cloak so key cloak communicates with our identity provider and that identity provider you notice it is not part of this infrastructure is actually something that is managed separately in this example it could be in here it could be part of your application infrastructure but it may also be a good practice to actually separate that out so that even if these continue if these happen to get compromised that your identity still still has some defense in it or some increased defense I'll say because you already have the zero trust model that's in there and so this so the user is logged in they receive a JWT and they receive it from a key cloak so key cloak itself allows you to have single sign on LDAP horizontally scalable it's you're able to log in with OIDC, OAuth2, SAML, social networks it was originally created by Red Hat and I believe it's been donated to the CNCF perhaps somebody can help me out there after we're done with the slides but the important part in this scenario is that it has the relevant things in order to allow us to integrate with identity providers in the back end give us a uniform give us a uniform interface for that handle the login and receiving and receiving and transferring of the JWT which then gets passed into your infrastructure and so this allows us to lift that zero trust even up to to try to defend the up to the client level even though there's limitations on what you do on the client at this point with those we have some some locations that you can go look at for some of this that were service mesh Biffy open policy Key Cloak, Envoy and Kubernetes a couple interesting areas where some interesting work has been done in here is of course never service mesh is continuing to build out this stuff at the Layer 2 and Layer 3 level Biffy is working on something called transitive identity so transitive identity it's imagine this client this is like a pseudo transitive identity that I describe we pass the JWT down in order to pass that through but you think of transitive identity as imagine the client itself having an X5 Online certificate that instead of receiving JWT it receives a certificate that certificate has been designed in a way that it can say application server I'm going to give you the authority to perform some action on my behalf to to the underlying infrastructure and so sort of like imagine you want to talk with a like you want to have a lawyer do something on your behalf for it or and so you're so you give them permission through some legal agreements to do something on your behalf through some transitive authorization do you think of a transitive identity as something similar and with that I think we have a little bit of time for questions we we certainly do and I'm going to because Luca asked a whole bunch of questions I'm going to try and unmute him and let him just ask his questions directly here there you go Luca hit it you guys you guys hear me yep yes yeah so thank you for the presentation first of all was really nice and really interesting I myself work as a solution architect in API management and I touch on some of these topics so I find this particularly relevant so when you were explaining the zero trust scenario I think you were mentioning the fact that VPN and ideas are still relevant but do I understand this right that in in this case you would basically just need to configure them to connect entire networks without worrying about sunnets and ACLs is that a correct assumption so that's a really good set of observations and a good set of questions and so in terms of intrusion detection systems I put that in there because some of the companies that I've worked with are they their current policy is that they have an intrusion detection system that's in there in fact if in the most basic level of intrusion detection system actually I personally don't think it's going to buy you that much some more advanced versions of these things could maybe help help you out a bit where if you had something that was capable of analyzing HTTP requests that come in and look for anomalies in the type of request that are being made or like then things that are there are more in band or that are working at the l7 layer and then I think that we can gain some significant benefit in in the model that I showed with with those type of with those type of things but they the traditional l2 and l3 model that's that's on there it's there may be some areas where it's still useful but it's but because you're you're limiting where your word receives messages from at such a fundamental level that it does reduce the total amount of value that you would get out of an idea even though there's still value there. Okay, and the other question I had was when you were showing the JWT validation I think this is the the OPA is getting a little bit into the API management field right because typically that's the one of the tasks that the API gateway can do so I don't know if you guys had already also an API management solution and managed to use that as well or or. I mean let me go a little bit more into this particular path and so open policy agent is just all all it really is is you think of it like as its own server and you can embed it into an application if you choose to do so you send it you send it a string of of JSON it responds back with a successor failure and maybe an explanation why depending on how you've configured it and so it's capable of consuming within those strings or within those best of skills you may pass in things like the headers or you might pass in some of the svids or JWT tokens and so on so it's not actually sitting as a as is not sitting here in this area of controlling the axis in between or or so on this is actually something that we would want to rely on something like on way proxy and all the proxy has to inspect and to perform that interestingly a lot of service meshes can help there because they already have connections and capability configure on way the there are still some gaps though because many of the service meshes don't implement the spiffy protocol or if they do implement spiffy protocol they've implemented in a very opinionated way that may not make it as easy to integrate with other systems and so one of the things that I've been looking at is working with some of the organizations for example I've been working with I've been having some initial conversations with some of the individuals over at Kong as an example in collaboration with with network service mesh because we have a core committer who is both a part of Kong and part of network service mesh and we've been discussing about since we use spiffy and spire within network service mesh already it would be good to be able to get that identity from spire in both NSM which we already have built out and also be able to get that identity from push into Kong so that that way you can reuse those identities at that location rather than having two different identity solutions that we have to work at how to make them play nicely with each other and so Istio also has a spiffy support through a product called Citadel I have not looked at Citadel so I don't know how well it integrates with like if I were to stick a if I were to stick spire on talk could I have spire control Citadel or can I do nested Citadel's can I get Citadel to to work standalone if I don't want to bring Istio and I want to start bringing in things like like these patterns that I showed off you could easily run them in an open stack or or other environments with given a little bit of development towards that direction and so and as far the reason I was looking at something like spire for this was because spire runs as a standalone it does not require Kubernetes but it ingrates very well with Kubernetes. Right. Right just one last question you were showing at the beginning when the you were explaining the setup for zero trust the trust between org one and org two I remember right. Yeah, this slide so is this like a typical scenario or in in practice you would have actually some more maybe just the department or even development group trust another development group to make it more strict in terms of validation so that nobody can actually like reuse the certificate and actually access somebody's else back end or would you limit that in the policy with OPA? Okay, so there's a there's a couple things towards this so what the way spire works is these certificates are very short lived so the default out of the box is that the the northbound CAs are rotated once a day the southbound workloads are rotated once once an hour I've actually rotate every 30 minutes but they're they have lifetimes of an hour and they're rotated 12 hours but lifetimes of a day so someone were to compromise a system and extract the certificate out they have a very short window to perform their their attack so that's first mitigation the second mitigation towards this is the way that spiffy that spiffy actually does the attestations so the attestations to go up the chain until you get something that can form the actual approval and so you're able to scope what type of approval so if I have say that I had like a third system under or the one that was like payments payments API and I tried to to a test that through the front end app server path and say well when I'm established in this connection and they're not supposed to be in the same cluster then they wouldn't it would not be allowed to act to perform that attestation because it would not meet the the requirements for that particular system so we can scope this down so that this cluster this sub working cluster is only able to receive certificates that are relevant to its to its needs and prevent it from the testing other things the reason that we want to trust them at the very top with the top level CAs in this scenario is that we also want it's a tradeoff to its to some degree where you want to minimize the the total number of connections that we don't want to say here like let's send the front end app server every time we rotate certificates here let's send that all over to second organization vice versa and so by establishing at the top you reduce the total quantity of communications on there you're not telling them hey I have an organization here's the structure by organization you're just telling them enough information so they know who they they're allowed to connect from and the other thing towards that is that it also gives us a single break the glass location because if org one and org two decided they don't want to communicate with each other we can literally destroy the trust here and that'll propagate through your system relatively quickly because when it asks for the next for the next bundle then that'll that'll end up removing the the bundle on there and if you compare that to status to the status quo of most organizations in this particular area I'm trying to perform that style of rotation without spiffy it can often take weeks or months if you need to if you need to go and configure and redeploy a bunch of software so it gives us that dynamicness that helps mitigate some of those some of those concerns that you are describing right so the just one last question given the explanation about spiffy so the whole rotation is managed by spiffy itself because I know that certificate management is always a headache in general yeah spiffy is a is a specification as far as cncf it's a cncf project now but it is a specification designed specifically for for doing the attestation of workloads and then rotating this over time so it's it's it's a gRPC based API it's very easy to to to build against but it's designed specifically for for solving that that rotation problem over over large organization okay thank you sure my pleasure I have just if you're done Luca I have a question a lot of this zero trust model is really about communication between services and technical between your internal systems and services but maybe for for Bobby how do you communicate this new model to your internal compliance audit IT people so that they trust you that you're implementing this correctly I mean that's got to be a big issue at a company like Anthem especially after the breach how did that conversation go down and how do you do that with like multiple acronyms throwing that all at the compliance officers and your IT audit people how does that fall out at Anthem that's a very insightful question it has not been it's not been as straightforward as it would seem but the the way we've started it is and just just to be clear today our chief information security officer our CISO is one of our key sponsors for making this change so that was something Frederick and I took on day one as we were talking about this and socializing it so it you're right it's a lot of acronym soup and it's a lot of new it's a very new models for traditional sorts of infrastructure so what we've started with is doing this outside of the traditional systems that are up and running and that are really running today so we're going to start first with proving this out in systems that are maybe let's call them less core if they go down things are okay if they get they get hacked or breached it's okay as we prove it out we'll see and the the CISO is working with us team working with us to watch how it works to do pen testing in fact we're making our source code public we and they were their eyes were like kind of we're in horror like are you are you serious yes no no we want you to know where every hole every weaknesses we want you will even make it public to the people you pay to come in and out your white hackers just white hat hackers just come on in and do this because we're we want to prove this out and we might as well prove it out with in the most dramatic and open and transparent fashion because this is what this technology is about so that's how we've started in to give us give us about six months and Frederick and I will have our internal prototypes not prototypes actual like functioning apps up and running we're past the prototyping stage and then Anthem is in general has not been a fast follower but as we're looking to move more of our core on-prem type applications into cloud they will just come on to our stack so we're even building our entire stack to that core applications they can bring their old security they can bring their old security paradigms with them but they will be on this new stack so they'll just be moving to the new stack and one of the issues Diane that people run into in the insurance or in the old traditional brick and mortar business that involved into using technology is if there are no customers it's hard to get people to change well they're actually bringing their customers with them so it's not a migration from an old app to a new app they'd be just moving their entire customer base onto the new platform with the new apps that they're moving from on-prem into cloud native so it's a big strategy it takes a lot of time and effort a lot of people to keep let's just call it kissing hands and shaking sorry shaking hands and kissing babies a lot of that as soon as Covid's out but just keeping the connections warm reminding them what we're doing and keeping this to the forefront of their mind but they also have they also have some headwind that headwinds we have some some wins in our sale in that it just costs a lot to do it the way we're doing it today and it's not sustainable those are all helpful things that work in our favor and so we've been welcomed with open arms well that's good news and in six months we're going to have you back to talk about where you are in production readiness and whatever lessons you've learned over the past six months and so I'm looking at well lead you kind of had one I think you had one other question and I'll see if Eric Eric is that has just asked a question a little bit ago does this rotation itself represent an attack surface me just see if it's a great question I would argue that anything that you can communicate with represents part of your attack surface that includes the rotations which means you have to have the proper security audits done on it make sure that you're securing those in points properly so I would argue yes that is part of your part of your attack surface and the same way that your firewall itself can be a or your virus scanner there's scenarios where fire scanners have had bugs in them that have allowed people to compromise systems and so please please treat I in fact I insist you treat it as part of your attack surface and that you you analyze it to make sure that it's being secured properly and that problems with within it are also are also mitigated spiffy and spire were designed with that in mind in terms of reducing the total quantity of privileges that towards the south pound similar to Kubernetes does is with with pods where he can expose portions of the API out but it will limit what what things in the southbound can do based upon its its capabilities and so but yes and ensure that that doesn't need to be that doesn't need to be considered well we're almost out of time and this is all new to me and new to a lot of the people who are on this call so we're definitely going to have to do some more follow-up conversations around this so that we can all learn from your experiences and your expertise so thank you very much everybody for for sharing this we really hope that you get something from this conversation I'll be posting it on YouTube and I'll get the slides from Frederick and post them as well on the open ship dot com blog and please reach out to both Frederick and Bobby the slot if you throw up that very first slide we didn't put your emails up there good on that that's a that's a trust surface that we didn't want to touch on or something no spam but we'll we'll figure out how to get you guys connected so as well as if you come into the slack for open ship commons if you're not there yet let me know and I'll add you in and we will continue this conversation online so thanks again Frederick for reaching out and Bobby for taking the time today and as always for being participants in the commons we truly appreciate that so thank you all very much and take care fantastic thank you very much thank you take care bye bye


Well, thank you everybody. I hope you're enjoying the global forum so far. It's obviously, there's been a lot of great sessions for technical and business. Everybody's out there meeting new people and learning about how blockchain is being used to solve real problems. I think we heard some good examples this morning in today's keynotes, as well as yesterday's. I'm Isaac Kunkel, and I lead the consulting services at ChainYard, and I'm presenting today alongside Mohan Van Katamaran, who's our CTO. We also are a sponsor of the global forum and very pleased to be working alongside the Linux Foundation and Hyperledger to put on this event. Today, we are gonna provide a high-level perspective on how blockchain, in harmony with many other technologies, is and can improve supply chain security to help companies fight fraud, tackle compliance issues, identify counterfeits, and maybe most importantly, just protect their brands. The information presented today is based on many decades of experience across industries and more recently, the last five years focused on how blockchain can improve the harmony and manage risks in supply chains. We're gonna move very quickly, even though we're getting a late start, I apologize for the technical issues, but we're gonna move very quickly and just share key points. The deck is available for a download to you lower in the screen. Feel free to ask questions in the chat along the way, and if we can't get to them today, we'll get to them offline with you guys. We are a digital transformation company out of North Carolina. We're part of a bigger company called IT People Corporation. We have a global delivery center in Hyderabad, India as well, and we specialize in helping companies gain business value. We have a special focus on blockchain technologies, user experience, user interface design, cyber security. We have a deep practice in cloud and DevOps, and we are more recently focused on AI and automation, partnering with big companies globally to help them with different areas, including their robotics, cognitive and cognitive efforts. One other thing I'd like to point out about our company is that we have, and you may have heard of it in a couple of sessions this week, Truster Supplier. We operate the global network for supplier information management and customer onboarding. We've also recently joined the Linux Foundation Open IDL project, which is a property and casualty blockchain project focused on improving regulatory reporting, at least as the first use case. We think there'll be many other use cases as that advances. Next slide, please. So this is a high level picture of a storyboard that Milan's gonna walk you through today. It's gonna talk about some of the foundational elements for supply chain security, and hopefully at the time, we're beginning, we'll be able to engage with you and answer some questions about the presentation, as well as talk to you about our vision for the future based on our experiences. All right. So good afternoon, good morning, and everybody. Mohan Venkatraman, CTO of Chainian. So I'm gonna begin with what are today's problems with the enterprise supply chain. So most of the supply chains of today are centralized. It is enterprise-driven. Each enterprise has got its own ERP systems internally or some custom solutions that all go together in order to manage the supply chain. And information between enterprises is exchanged through the use of EDI or JSON or XML. And most often, they get lost in translation and lead to data quality issues but other kinds of problems. And finally, this supply chain today is controlled by the lead buyer or the seller who is in charge of that business collaboration. Now, if we look at all the issues of why there is a trust issue and the central issues in today's supply chain, yes, there is a trust issue. And the trust spans a number of areas. Some of it is like product authenticity. Do we know this product that we purchased is real? Do we know how the supply chain processes were handled? If a supplier goes out of business or if a supplier cannot deliver, can we quickly switch over to another supplier? What kind of quality of data am I getting, like in terms of the constituents of the product but in terms of the order, in terms of the invoice, compliance with good manufacturing practices? Am I complying, is my business process complying with good manufacturing practices that have been embodied? Siloed processes. Today, each partner in the business network is in a siloed way collaborating. Their systems are duplicated. The same processes are duplicated. Expensive IT infrastructure, disparate systems. And finally, you do not have standards consistently implemented across the supply chain, be it SOX compliance, be it privacy or any other requirement. So if you look at a typical supply chain, it's a relation, it's very simple. It's a relationship between a buyer and a seller, but yet it is very complex. A buyer places an order on a seller and the seller then acknowledges that order and then gets a factory or a contract manufacturer to manufacture the product. Now the contract manufacturer in turn issues, which is orders to suppliers. As they get all these components, they manufacture the product and then based on a delivery order, they move that product across the supply chain. Now along this process, there are a number of organizations and people handling this product. It goes through cross-borders. It is processed by transporters, by pickers, packers, shippers, logistics operators and many other folks. And so hence it is prone to problems in terms of errors. There could be fraud, there could be counterfeiting and there could be any type of other issues. Obviously we have seen this issue, right? In the recent COVID pandemic, we did see there was a supply chain disruption in the PPE or the supply of, you know, sanitation products. We also saw recently the Suez Canal was blocked and therefore the entire supply chain was disrupted or more importantly, the lack of availability of chips is disrupting the automobile industry and many other industries, right? So we do have to see how can we have a better supply chain that can be trusted. In our experience or in our vision, the supply chain trust is built across four pillars or four legs, you know, it starts with the supplier. Supply chain is about, begins with the supplier. The supplier is the one that delivers, you know, that supplies components or delivers a product, we need to trust the supplier. The second is we need to trust the product, right? The product that we purchase, we wanna make sure it has been manufactured with the right quality. You can trace where the product, the provenance of the product, what were the pieces, where did they originate and how they were all put together? Or we do want to know if it is, you know, proof of quality or it doesn't include conflict minerals bad in a child level practices. We also wanna trust the process because most of the problems in the supply chain happens along the way where a fake product is injected into the supply chain or some of the cross-border compliance issues like lack of documentation. So how can we bring more trust into the process? And finally, identity, which means we not only do we need identity of the suppliers or the business participants in the network, which is people, we also need product identity, you know, by looking at the product, can we correlate it to all the events around the product, including proofs that the product was manufactured but any other verifiable claims. And the third thing is things, you know, IoT devices and other sensors are watching this entire process, right? You have cameras in the shop floor to all over. So all these we have to be able to trust that they did the right things along the way. So let's see, if we have to tackle the problem of supply chain, we have to take a very holistic approach. It's not blockchain alone or it's not AML alone or it's not IoT alone, right? So we do have to look at all the technologies that are available and depending on the product and the type of supply chain, we need to have a holistic solution, like whether it's a petroleum supply chain, a retail supply chain, manufacturing technology supply chains, media supply chains, each one of those supply chains require a combination of solutions, but they require current technologies to be applied very effectively. So moving forward, let's see the first technology that we've always got used to is blockchain. That's why we're all here. Blockchain allows us to bring trust, transparency, modability, privacy into the mix and that's a very key element of the trust and supply chain. We also rely on price certificates, like X519 certificates that can be associated with products and parts and so they can all be correlated and can be cryptographically verified. The third is how do we track the asset itself? You know, the asset lifecycle, we also want to track the asset provenance. We want to make sure that the asset is compliant and it is sustainable in terms of the manufacturing process and so we do want to have some auditability and that is all provided by the blockchain. The second key technology is IoT and AML. We did talk about it briefly, but IoT in the sharp floor keeps track of the manufacturing process and how labor is treated on a truck or on a supply chain. It is looking at whether the truck left the geo fence that it was supposed to be in. It also looks at whether the product was opened and exposed to light or subjected to temperatures that it is not supposed to be. Very critical and the supply chain, the IoT data then gets translated and recorded on the blockchain but also gets translated into verifiable claims that one can associate with a container or a consignment or a shipment or a ship unit and finally to the product itself. Machine vision is another important technology supported by AML. If pictures are taken of the manufacturing process or all along the supply chain, those pictures can be associated with the batch or the lot or the product itself and if an end consumer receives this product, they can take images of their product and they can compare it with what AI says and verify if the product is truly authentic, whatever they receive. And this has been applied, right? So there are companies that actually apply this like Gucci and Louis Vuitton. The next one is about tags. And today, tagging technology has come a long ways. There are copy proof tags that cannot be duplicated. For example, in this picture, what you see on the top is a medical product. It is actually a carton of a Zempik. It has got the copy proof tag on the left side. It's a Zoltag. The Zoltag has got a 3D image, a 3D section in the circle, which is created by molecule droplets and that has been encapsulated into the QR code on the site. So there are different tagging technologies available. There are thermal sensitive tags, there are RFIDs, NFCs, 3D based tags and also standards, GS1 standards define how do you package and how do you label a product. Finally, we do have digital identity standards. You know, everyone in Hyperlegionano's, Ares and Indy, they all apply the digital identity standards defined by the Digital Identity Foundation and it's all about a digital identity that can be universally resolved and they can all point to verifiable credentials and these credentials can be applied and the identity can be applied to product things and people. So applying their digital identity as a way, an example of a digital identity is shown in that little square box. It's got DID and it's got the namespace and then the actual identity in the last part and it can be connected to profile of the product. It can also be connected to other verifiable claims. So using this method and tying it to the serial number or the model number or the lot number package, we do have a truly traceable mechanism for the product or the asset. Now, lastly, if you don't have a great user experience, your entire, you know, supply or trusted supply chain mechanisms are going to fail. People want a very simple interface by which either they can scan a QR code, that's QR code, maybe a digital identity or a serial number. It takes it automatically to the manufacturer's database for the product profile, to a blockchain database for supply chain events and any other AIML database for proofs of authenticity or verification. So it has to be very simple and even the proof of which is this have to be with embedded secrets that only the which is it knows so that nobody can tamper with it. Now, if you apply all these things that we see in the four legs, you can see it a laid out process, right? At the top, you know, the box, first is to qualify all of our suppliers and partners. So once we have qualified our business partners, the next step is to make sure that the product is properly labeled tagged. So whether we apply a serial number and assign that tag, we can also assign digital identities. We can assign prior certificates, X519 certificates or root certificates that tie the product and the components together. We can also apply digital identity and we can finally tie the IoT machine vision images to the product itself. So now the product has been secured with identity and standards and verifiable claims created by IoT and AML. As the product moves along the supply chain that the DID can be used to resolve the product authenticity at any point in time. You can also scan the process and the events that happen by the driver at the warehouse, by the 3PL in a distributed location. All those scans are captured. And finally, you know, at the end retail level, one can use a simple scan to go and retrieve all this information universally so that one can determine whether the product or the retail store is authentic or not. And the end customer can get a proof of purchase that is embedded with secrets. And that secret can also point to the authenticity of the product that they purchased. A very simple architecture here is combining all these things together is you have the blockchain here, you have the client application and the connected to the IoT gateway, the API gateways to the enterprise ERP systems, a beautiful user interface, off-chain, on-chain IoT databases that are connected to AML and that can process and give us predictive analytics and classification data. And finally, key management so that there is security in the system. So in our view, I think like it is possible to have a trusted supply chain. The cost of trying, you know, securing the supply chain depends on the type of product and how much we want to invest in each one of these technologies. But then I'm going to hand it off to Isaac to take us through the rest of it. Hey Isaac, hello. Turn off mute to avoid the echo. I think you missed the, there's a vision slide before this but our vision is to basically take a look at all of these different areas that are pretty siloed today. And we do think that some, at some point there will be different solutions that will come together to bring more transparency to the whole supply chain. And we have, we see this today in solutions that are out there like trade lens who's helping with the cross border problem supply chain financing solutions that are out there, trust your supplier, the Walmart, Canada logistic solutions. We see blockchain being applied in different silos today but we see that those things will come together and work together. Whether they're through a blockchain interoperability or just through APIs, we don't know but we know that this is part of the journey is to take off small chunks and find business value in the near term. So this is our perspective where things are going in the vision. You know, and it just goes on and on in terms of lifecycle of products and recovery of products. And we do see it as all highly connected even though today we treat these things as silos. On the next slide, Mohan, we are basically, this is something we've been researching and working on for years now. And there are certain projects that we have worked on that are part of the different supply chain and helping to secure the supply chain. Sometimes upstream, sometimes downstream and sometimes in life. But these are just examples of some of the things we've done that are part of, for the most part, supply chain related solutions or I'm sorry, supply chain related projects and or complimentary to the supply chain in terms of business and functional needs. Beam is one that's about asset and lifecycle management worked on. A couple that I won't go through all of them but secure document sharing. Key to so many different projects not just supply chain and having being able to have immutable and trusted documents that you can go back on can improve transactions and trust so much. Part certification that Mohan alluded to earlier, the X509 certificates, that could be part of your blockchain. We mentioned trust your supplier earlier. Having wallets that can store different credentials or tokens that are related to what you're doing. This one's a little skewed to supply chain specifically but there's some opportunities there. Trust your product is a solution that's specifically about brand protection, fraud prevention and being able to use some of those unique IoT devices and different tags to help manufacturers protect their brands and avoid fraud that's going on in marketplace heavily today in some industries more than others. We even see things that in life in terms of assets being able to track software licensing as a service and this is something we worked on as well in terms of in life of assets that are deployed. And then one other project we worked on was business compliance. It's not so much supply chain as much as making sure that when a manufacturer's putting business terms out to one of their distributors, making sure that those business terms are being followed when they're selling it out to their clients and that there's, that can be trust across that set of transactions. Next slide. And I mentioned trust your supplier again. This is one that's nearing through our hearts but I don't know, there was a couple of presentations on this already but this is one that's a global network. It's got more than 30 Fortune 500 companies operating as buyers, another dozen or so third party verifiers and over 5,000 suppliers who are working together to facilitate their transactions in terms of there's supplier information management and the onboarding process. It's not doing any of the transactions in terms of the actual invoicing and those kinds of things but that is obviously part of supply chain as well that taking care of getting the payments done in a trusted way. But this is a great network about qualifying verifying and onboarding and this is significantly reduces risk for many, excuse me for buyers and manufacturers and it more importantly accelerates the times of that first transaction. So there's big value in it for suppliers as well not to mention the operational efficiencies that these companies are saying. And I'll try this one back over to you for our future. So yes. So what we see in the future and we have to be prepared for it, right? So as we architect these solutions we don't want these solutions to become siloed. So the way we see it is that blockchain powered ecosystem new ones are constantly evolving, right? There is a cold chain which has been built by Chronicle but then Hyperledger has got a trusted supplier and built in fabric and there are many other solutions but there will be some level of maturing of each one of these networks. We also see that supply chain documents such as POSO and a bill of lading and others essentially will become contracts that are smart contracts and those smart contracts will be universally agreed upon by all the business partners. So there is no issues around will become ultimately law, right? We also see the role of the ERP will get reduced to serve more internal business processes as opposed to working outwards with other organizations. Tokenization of identity, process, assets and powering transactions using stable coin will become more prevalent. We already see assets have been, I have a digital twin, the assets, the transactions around the assets and so on. In future there is a potential for, I've gone the opposite way, so forgive me for that but in the future there is a potential for networks to converge, expand, exist or coexist, migrate, interoperate. So we cannot have, there will be many different supply chain projects but then they all have to coexist together on either they have to migrate or merge with other engineered, you know, other blog networks. Then you obviously AI, ML, IoT and even augmented reality and virtual reality will start playing a role because virtual reality and augmented reality are already helping in terms of service management manufacturing processes but then the blockchain will help secure whatever decisions were made using AR, VR and there is trust in the actions that have been taken. And finally, another aspect is decentralization will drive more focus on addressing supply chain errors, fraud, counterfeiting, that is what we discussed so far. Finally, the expansion of data privacy and protection of intellectual property rights will become pervasive. So every solution that we build where there is collaboration in a public space will have to apply these regulatory requirements. So that's how we see things going in the future. And so our architectures have to support this in the supply chain space. With that, I do wanna say thank you and I'm gonna turn it over to Isaac and myself again to answer questions that may be coming up. Yeah, thank you, Milan. So everybody, there's, you know we've had about 35 people on the session today and we're happy to answer any questions through the chat. There's a Q and A button on the right side and we can answer those questions. We're happy to share the slides either directly or through Hyperledger. There's links provided. And if you wanna have a chat about any of this or other blockchain projects that you're doing, feel free to visit our booth at the expo and talk to either G. Joe Joseph, Tom Hickman or myself. And of course, you're free to reach out to Milan or myself anytime, email. That's available at Hyperledger as well. So with that, are there any Q and A? So I don't see any questions in the, I don't see any questions. But, you know, so, you know, in the interest, you know, we do have, do we have time or have we consumed our time? We have, we are actually right at time now. So we started a little bit earlier than that. All right. So thank you so much, you know and as Isaac said, you know, any questions that are there, please shoot it over to us and we will be very happy to answer questions or even have a brainstorming and talk to a provoking discussion. All right, thank you everybody. Have a great rest from your Hyperledger to the little forum event.