We're here, Liz Trotter, our guest today is Laura Smith. This is smart business, Rose. Yay, hey Laura. Hey, thanks for having me. Yeah, we're glad you decided to join us. We know you're super, super busy right now. Well, actually, I guess you've kind of been super, super busy for like the last, what, two and a half years or something. Yeah. Yeah. I'm so sorry. We need to find out what busy it is. Hey Denny, good to see you. Denny, it's up there. So what's been happening since last time we're on here? I'm just barely coming out of like a two week fog. So I haven't even had a nap today. You had way too much fun in Las Vegas. Oh my gosh. I really wish that was true. I've heard a lot of Las Vegas stories. I don't know, we might need to drill on this a little bit. You didn't hear any interesting Las Vegas stories about me, Tom. It was not an exciting Vegas time for me. I was sick way too long. Can you believe it is December? I feel like every month, Tom, you just try to abuse us by telling us how much closer we are. Well, minding us how quickly time's going by. I mean, it's crazy, isn't it? It is. So we're going to be doing budgeting and goal setting in December, which I guess is what a coincidence, because normally those are good things to do in the month of December, right? If you haven't done them by now, December is kind of your last chance, is my thinking. I kind of like to start with at least goal setting in October and November. But if you haven't done anything by December, come on, y'all. You need to get it together now. Get on it. That's right. You've got to get on it. And it's the last month of the quarter or two. So we're, yeah, you know, hopefully. People are hoping for it. These are the schemes that are like 2022 coming in a month, and I'm still processing 2020. But I still feel like I'm stuck in 2019. Amber. Amber, you do not have interesting stories. But Amber, I think I might have been a little bit sick when we were sitting in the hallway talking. But that was big. Convention's very large, lots of air there. So I haven't heard of anybody else coming home with COVID. I would definitely feel guilty. Well, you know, I guess there's more than one possibility as well, so. Yeah, I would still feel guilty when I was speaking into a little avalanche, especially on the last day. I really did not feel well. And I told the guy that had mic'd me up. I was like, yeah, I think I have a cold. So make sure that you disinfect this really well. And when you took it off, I didn't seem to disinfect it. I was like, dude, if you have COVID, it's your own fault. I told you to just disinfect it. You know, it's not good. Well, I normally have a lot more energy, so. So we are going to be talking about goal-setting today. And Laura, you have kind of some thoughts that you're going to share with us in that regard. Yeah, I would love to share the way that we do goal-setting with you guys. I think that we have a very structured approach compared to a lot of people I've seen. And we're very good at it. So if it's OK, I'll share my screen with you and show you guys what we do. Awesome. OK, let's see. Tom, did you notice Laura's eyes on Zoom?  I'm like, man, they're so pretty. They look like you're off of some TV show or something, Laura. I do love Zoom just for that reason. Yeah. Can you all see my screen? Yeah. And you should, like, turn the green screen function on with your dress and everything else. That would be wild. Tom, what are you talking about? That would not be good. I mean, it's not like it makes a discipline. It'll have a little background.  Tom, you can't win here. I'm just going to keep laughing. OK. Why do you want to see Laura without her green shirt? I don't know, but at least not going to like her. Derek's not going to like that. Yeah. All right. So, Laura, we can see your screen, but it's too small. Oh, it's too small? I can make it a little bit bigger by doing this. I'm like, oh. Oh, now I'm having a crush on it. How about that? Any better? Well, it's I have like a 52 inch screen and I can't read the words. OK, I'm going to give you all a really weird view by going back in the stream yard for a minute here and see if I have other sharing options. You might just need to like zoom into one smaller area. We've got so much. I'm going to just give it a big command. Hold on the command key and hit the plus button and it will zoom in a little bit. OK, how does this look? Any better? We got to share. Here we go. Hit command plus again or control plus. Come on. You must have you must have control. The bottom left hand button. OK, that apparently doesn't work on Macs. No, that's why she's mad.  We're we're we're screwed. Laura, do you have a command button? It is my plus on the Mac. I don't know Mac. OK, I'm zooming in manually. Is this working? Yep, it is. OK, is this good enough? Do one more. OK. There. Really good. I can see it pretty good online. How about you, Tom? See better? It's awesome. OK. OK. You have to square it. So the first thing that I want to tell you guys is that this is in progress. It's not a new thing that we do, but we have been moving it into air table because that's where we're hosting all of our documents now basically. That's where ops manual is. All of the other things that we used to do in spreadsheets, we do an air table. So Aja has actually been working on this today. She's been moving our documents from other places into this air table. And she actually broke it right before I got on.  And she fixed it. So I could show you all of it now. But there are like, you will see some things that have dates and things like that in them yet. Oops, that's not because they don't have them. It's because it hasn't all been moved in yet. So anyways, this is basically how we break down our goals. So we have an annual goal setting meeting every year. And then, sorry, this Zoom thing is kind of rooting me out with how my mouse works. Shoot. Trying to figure out how I can move. Oh my gosh. Sorry. Well, I can tell you a really good way to fix this. Just go get a real computer. OK, I haven't figured out. So we have an annual planning meeting every year for the coming year. So you can see some of our 2022 stuff is starting to go in there right now, because we had our meeting in November. And then we have a quarterly meeting every quarter to basically kind of keep ourselves in check. Are we making our goals? Are we not? What needs to be altered? Things like that. And then every week, we have status meetings with every position within my company. So I'm just going to walk you through real quick what this looks like. You can see here, this is the stuff for our WIG project from our most recent meeting that she's in the process of putting in right now. This is just books to read, just stuff we keep track of, things that we're going to talk about. And then we have different areas of the business. So stuff that needs to be done with, stuff that happens in the office, stuff with teams, stuff with marketing, stuff with clients, stuff with quality. And we have one called Made Central wants. So this is where we're listing out all the things that we wish Tom would do for us. I don't see anything there. Oh, there's lots there. Just do that number. Does that little number on the left mean there was like 20 things that you want? All. Well, that's all that's in there so far. Anyways, obviously you can see there's different views here. You can see it in this sort of view. You can see it based on due date. We have a thing called Maybe Sunday that we do where we put projects that we're not working on right that moment, but that we would like to do at some point. And then you can see incomplete or you can see complete. And then for each project, again, I'm going to use my little bar here, we'll have a category, status, kickoff, all of that. So then here's where our actual goals start coming in. And here's where you can see, like I said, we're building this right now from our old, we actually started this process on paper originally and then it moved into a spreadsheet. And now we're moving it into air table in advance of the class that we're teaching. So it'll be easier to share with people. So that's why some of this is not done. But you can see I can filter by AJA or I will be able to filter it by any individual person who works here. We can see incomplete, complete non-recurring. And then within each goal, fine ones that has some subtasks, we can open that up and it will link the tasks related to it. So here's our goals. Man, she's been working on this today. Let me find a better one. Here's a better one. Okay, so like here's one of the goals. One of the things we talked about is that we felt like we weren't making the best first impression with our clients because their communication or their expectations were not always aligned with ours based on our communications. So one of our goals is to improve that this year. So here are some of the tasks that we're going to do to improve that. So we're making client folders, anniversary present, calling all the initials before the first clean and discussing with them, checking all of the initials, altering our sales script, et cetera, et cetera, you can see. So we can open all those up and those all are under tasks. And again, you can filter them by the person who's responsible with them. And then you can see for each task as well what all of the subtasks for it are. And we can assign multiple people, we can add notes. We can do all sorts of stuff there. So that's the general, these three tabs are the general. What three tabs? Growth projects, goals and lead measures and tasks. Gotcha, of the time. Are the three tabs that are, that's what are basically our annual goal setting and our quarterly meetings revolve around. And then we've got status reports. And so these are weekly and this is what it looks like. So this is the sales report. So my sales person would go in here or does go in here. As I said, this was on paper until recently, but they go in here and they fill this out prior to meeting with me every week. I have been doing these meetings since Aja is transitioning out right now. Soon our new GM will be taking these over. But as of right now, they're meeting with me. So- Rohan. I'm answering Rohan's question, it's air table. Oh, okay, yes, it's air table. So my sales person goes in and fills this out prior to our meeting. So then we get together. And this is what it looks like when we get together. I sit down with them and I go through and read all of his KPIs for the week. So how much is in collections? How many clients are over 30 days? What's our close rate stats for the week? All of these things. So we're gonna go through and look at all of that. And then what tasks are you working on? So they can link a record from tasks here to show me what they're working on and we'll check in on the status of that. But then what we can do is, while we're having this meeting, so I just sat down with him, reviewed all of his stats, reviewed the tasks that he's actively working on and got an update on those. But then let's say we decide, okay, well, I really need you to send out another email newsletter this week because we could use some more spots filled next week. So then I just add a new record and I can assign it to, okay, I'm gonna assign it to Aja, Colton doesn't have one on here yet. And then we can put anything in here that we want about that and we can go ahead and say that. And so then that will show up in his tasks for the week. And so then next week, he's gonna have to report back on the completion of that. Does that make sense? I'm understanding the accountability piece. The part I'm not understanding yet is, maybe you could break it down for us a little bit better as to how you set the different goals.  Do you set goals like that also or do you just set like problem solving goals? We do. As I said, a lot of this is kind of in progress. So being moved into air table. So I'm showing you what we have in here so far but we do set those goals. We try to set all of our goals based on true data. So a lot of you have seen my all the things spreadsheet before which is also hosted in an air table but that's something that we fill out every week that tracks our daily, weekly, monthly KPIs. And so typically what I would be doing in the meeting in the weekly meetings with the operations manager is going through those APIs and looking for ones that we don't like. Like is our attrition creeping up? Is our attendance getting really bad for our cleaners? Do we have enough cleaners based on the revenue? How much are we rolling? All of those sorts of stats we're gonna look at every week. And if they're off, then we're going to in the status meeting here we're going to create tasks to address that over the next week. In the annual meeting, we're gonna take our previous years or current years results and then we're going to think what can we do from here? What is possible? What are we going to work on the most? That's gonna move the dial the most this year. So we use Derek's made service what if spreadsheet which I know a lot of you guys have seen before but typically that is how we come up with those goals is we plug those in and we decide what's gonna make the most difference for us to focus on. All right, so let's start there. So for an annual goals, you sit down with who? Everybody who works in my office. Okay, which is who? I have Aja is the current GM who is on her way out right now. Alex is going to be my new GM. Nancy is my field manager. Brandy is my QA who she does not always join our meetings but she does if she can because she's in the field a lot and Colton is my salesperson. Okay, so this meeting here, this annual meeting, it's just once a year though. So Brandy would be at this one, right? Yeah, she was at the annual meeting when we just did it recently. She thought I was at the quarterlies. Okay, and so at this meeting, this annual meeting, how long is that meeting? Laura, I'm trying to help people understand like some basic structure of what it might look like. Who's gonna be at that meeting? Who's deciding on the goals? Where do they get the numbers? Or what types of numbers are they looking at? Kind of taking it down to a more granular level. So typically our annual meeting takes the entire day and we will rotate people in and out depending on what part of the business we're talking about so that we have phone coverage. But everybody does participate in it, typically takes an entire day. Quarterly meetings typically takes about three hours to do our follow-up and then our weekly meeting takes anywhere from 30 minutes to an hour depending on which position is being met with. The meeting between me and the ops manager is about an hour every week and then me and the salesperson is about an hour every week, I'm always the one who meets with him because he does our marketing and I was the marketer before Jano got sick. But then the typically the ops manager meeting with the field manager and the QA is gonna be more about 30 minutes a week just checking on KPIs. Okay, so for the annual goal setting this is gonna be an all day event. You're gonna be there all day, like eight to four, eight to five, something like that. And you're gonna keep bringing people in and out. Is that what I'm hearing? Like start me off. What is eight o'clock look like? What is the morning? So if we are talking about field related stuff the salesperson does not necessarily need to be there for that, so he will go cover the phones. When we're ready to talk about sales, we bring them back in. All right, so this morning thing where you're talking about the field related stuff is this from like eight to 10, eight to nine, eight to 11, eight to noon. What are we talking about there? Oh, you're getting real specific there. Okay, so here's the problem that people have with goal setting. It's not that they don't know what goals are. They don't know the how of doing the goals. Like who do I talk to? How long does it take? Do I just sit down and say, okay in 10 minutes say, here's our revenue goal and here's how many clients we wanna have and this is how many employees we're gonna need to get there. All right, have a good day y'all, is it that? But so you're saying it's an eight hour event. That's why I'm saying, oh, you're gonna have to break that down for people because they're thinking it's like a five minute meeting where they just tell everybody what the goals are for the year. No, our goals have to make sense to us from a data standpoint. Again, if you just throw something out there in the dark and are like, hey, I would like to have 200 more clients next year. That doesn't really tell you anything about how you're going about getting there or if that's even a realistic goal. So I mentioned Derek's what if spreadsheet that does belong to Derek. So I can't show it to you. I think most of you have seen it at some point though but basically it's showing you the difference between if you tweak the number of leads you're getting, the total amount per average cleaning that you're charging, the attrition rate and one more. I can't remember. I can't remember. Anyways, so we go through with our real data which I'm gonna show you in just a second. Recurring service frequency? Oh yeah, I think that is it. How many times they're clean for a month? Yeah. So I mean, this is what we've just did is we brought up that spreadsheet. We went through all the things which I'm gonna go through and show you guys a quick overview of here real quick. So we took our historical numbers, plugged them all in and then for each one that we would play with, well, okay, if we can improve this one by this much, if we can improve that one by that much, we decided the formulas could make the most sense for us so that we're focusing our energy in the right places and then we went down from there and broke out, okay, well, how do we do that? What are some of the things that will make that happen? So this is all the things. Why do you guys have seen this before? We just put it in this new interface so it looks a little different than it used to. I can show you the original as well but we've got a dashboard for quality so you can see this is my goal this year. My attrition is too high right now. Anything over 3.5% is way too high for me. So this is where the majority of our goals that came in this year. But we can see how many weeks in the last six months have been above 90% what our response rate is. So that's quality and then we've got hiring, revenue and sales. So these are the things that we're using and I'm actually gonna go and show you guys the non-interface version because it's a little bit easier to see. So this is where they put in their numbers daily. All of the other, this is the only one that we alter. Everything else filters in itself from this sheet. But then you can go in and see weekly stats and then they add themselves up by month. And so we can go through and see all of those. And then I've got this little handy dandy guide here of where we get those numbers and made central. But effectively this is what we're basing our data on. We're looking at this and going, wow, this number right here is not okay. You know, like this number is pretty okay. I'm not gonna worry about that one. So we're not setting goals around this. We're averaging exactly 40%, which is what I want. I don't think people that aren't familiar with what you're showing us, Laura, don't know what you're talking about when you say this number is okay. Like that's what you were talking about, your direct payroll percent to revenue, I think. Is that right? This is direct payroll percent to revenue. So we're averaging 40%, that's what I wanna average. So this is not a big focus for me this year on goals. I don't think that I need to work on how to reduce my payroll percentage to revenue when it's exactly what I want it to be. Whereas my attrition is where did that one go? Averaging 5.7% for the year. God awful, so I need to fix that one. So yeah, we go through, you know, this is another one, scorecard average. We average 98% most of the time. I don't think that that is necessary for us to fix. So that's kind of where we're starting is we're starting with all of our real data and then we're looking for where do we need to make improvements here? Once we identify the improvements, then we're breaking it out. Okay, we know the end goal, but what are the steps to get there? All right, Tom, why don't you ask some questions for some things that you think people might wanna have a little bit more clarity about? Also anybody that's on a call on the call right now, I know Linda's on here, Amber's on here. Actually, we got a couple of different Lindas to meet. Do you guys have any questions about how you might start or what you do or what you might wanna do differently? Yeah, we've got a lot of people here. If anybody has any questions, just go ahead and drop it in the chat. We will take it. It looks like it's a fair amount of ongoing maintenance here. A lot of numbers that are being entered. What is the process that you use to maintain this? My experience is a lot of times, companies will start implementing a process like this similar to the same idea concept, and it kind of breaks down because people don't really take ownership of it and do the things that they're supposed to do at the time that they're supposed to do it in order to make it work.  So how do you actually make this work day in and day out? So if you're referring to getting all the data and ongoing maintenance in regards to all the things that I was just showing you all of our reporting, that does have to happen daily, but it takes under 10 minutes. It's not a huge thing to do. So that's a non-negotiable for me because I am entirely absentee. The only time I have anything to do with my company these days is like two hours on Fridays, I hold meetings. So I need, ooh, sorry, I'm sorry for my daughter's afternoon meds, but she's not here. Some things are just non-negotiable in my company because I am completely absentee. So I need to be able to look at what's going on without having to hound people and ask them a lot of questions. And how often do you look at that one particular form? Do you look at those numbers daily? All the things? Yes. I do not look at it daily. I look at it at least twice a week though. Okay.  It just, it had to become a non-negotiable thing for me. Once we built it, it is, and it's not, I mean, it's a really core part of our company. It's a really core part of how we operate. So it's not something I'm fighting people on. We all need that data. So they fill that out daily. That's the only tab in there. They're filling out the rest auto-generates from pulling data from the daily KPI tab. So that happens with that. This, like I said, this is not, so just to explain a few more things that are gonna be in here right now, we have the growth projects, the leads, tasks, and then the status reports where we do the weekly meetings. And that is really a big part of how we hold people accountable to doing what they're supposed to be doing is we check in about it every single week. Every single week we're going through all the things that are assigned to them and they have to give us updates. And so if something is going awry, we're gonna figure it out really quickly and we're gonna have a conversation about that. I'll tell you, I don't really have that problem. My office people are amazing. Like I am so blessed, but I truly don't have that problem. But the other things that we're going to be adding in here that we are moving over from our spreadsheets and things right now is our annual planning structure. So coming in here, showing you this report, again, this is the weekly report. Well, we have a whole annual structure of the things that we go through when we're doing our annual planning. So those are all things that are still kind of making their way in here. As we're consolidating our use of software, I guess. But yeah, I mean, that's the short answer is just there are some things that are not negotiable in my company. All the things is one of them because I do, I have to know what's going on. And if I'm sending them a million questions a day, being like, how's this going? How's this going? How many staff are we short? Are you, did you fill up next week yet?  So they spend 10 minutes every morning filling that out so that I know what's going on. And so they know what's going on because if they're not monitoring that information, then we're not scaring, you know, we're just floating. I think it's a lot like, for people that aren't familiar with how this works, I think a really good way to think of it is you don't really have to remind somebody that drives their car to look at the gas gauge every day when you get in the car because if you don't do that every day, you're going to run out of gas. So you have to, it's part of the job of driving is to watch your fuel consumption. And you really have to keep reminding you to do that because you're used to doing it every single day. It would just not occur to you. And it's the same thing as like putting on your seatbelt, Tom, is another really good example. You know, somebody might forget to put on their seatbelt one trip to one place. They're in some kind of a weird thing, but the minute they have a chance, they're going to jump right back onto putting their seatbelt on every single time they get in the car. Is it okay if I turn off my share and come back to the camera now? Sure, of course. Okay. Sorry, I can't stand it when I can't see myself when I'm talking. No, Liz, you know, I don't check the gas gauge every day. I just kind of cover it up. I actually know that you do, and then you ignore it. You look at it every day to see how many more miles you can eke out of that 10th of a gallon that's left in your tank. You know that gas prices are going up, though, I fill it up more often. It's when they're going down that I try to wait another day to... But you still look at it every day. You still watch it. So the whole idea here that Laura I think is just trying to get across is it's not anything that it shouldn't have to remind people to do it. It's not something that she has to say, hey, did you fill in your all the things? No, because that's the normal part of their job. Just like you don't have to call all of your technicians every day and say, hey, did you clean the toilets? Of course I cleaned the toilets. Why wouldn't I clean the toilets? My normal job. Yeah, my company is really, really built on structure and it has been since before my daughter got sick and I had to basically abruptly quit my job. But we've always had this... Well, I wouldn't say all this, but for the last six years, we've been working on this foundation of structure and it's much easier to get people to comply when it's already laid out. When they know exactly what they have to do, when it's really clear what they have to do and how they have to do it, I don't see as many of those compliance issues. It's just part of the job. Like you said, it's how our company runs. We have some questions we want to get to, but... She didn't answer, Denetia. Oh, okay, you want to get back to that. Take a point that Matt's here in Charleston. We're working on some main central stuff and you take the late flight in, so we dropped a car off at the airport, the drill and doesn't have to look at the gas gauge, though, because my staff is awesome. It's clean and it's got a full tank of gas. It's just like a rental. And you don't have to worry, Matt, because don't forget, Tom always checks the gas. You're going to be safe for at least a few days. All right, so Denet actually has a question. We actually have quite a few questions coming in, Laura. But how about this one for Denet? Okay, so yes, my attrition needs some tweaking, so can I elaborate on the start of the full setting for that issue? Let me go look real quick and see if all this stuff is in here or not, because I might just be able to show you. We can share your screen again if you'd like. Yeah, yeah, give me one second, okay.  I do have a bunch of stuff in there, so let me show my screen again. So I think one of the messages that Laura really wants to get across to people is that when you're doing your goal setting, that you're using actual data. Find the data, start there. Don't just start with, okay, how much money do I want? Okay, I want to be a million-dollar company and so I'm gonna, that's gonna be my goal. Those are wishes. Yeah. Those are wishes. You have to know that it's possible for your data and then you need to have a plan to implement it. So this is a little bit of our attrition project that is in here so far. We're not sharing yet. Oh, it's not sharing? Not yet. Okay, hold on. How about now? Yep. Yep. Okay, so this is a little bit of the attrition project that we have going right now. Some of the things that we decided when we really sat down, again, remember this meeting takes a long time and part of it is because we really spend a lot of time trying to brainstorm what the core of the issue is. So we can look at it and go, oh, we're having a lot of client turnover but we didn't know why we're having that client turnover if we're gonna fix it, right? So one of the things that we came up with is that a vast majority of our clients that were leaving us were leaving in the first 90 days. We have found this to be true both with cleaners and with clients that if they make it past 90 days with us, they will typically stay for a couple of years. Almost all of our cleaners and almost all of our clients leave in the first 90 days. So we started brainstorming like, why, what's going on with that? And we decided that we weren't setting clear enough expectations, that we weren't always making good first impressions. We had a issue with, we had hired a bunch of new people after COVID. Not everybody was like 100% on doing initial cleanings because we don't actually do almost any one-time cleanings. I don't know if you guys, if I've mentioned that but so our people don't get practiced with initials other than at initials because we're really not doing any of those. And then client communication. We had some people, we went back through all the people who canceled the last quarter. We had some people that were canceling because they were frustrated with us because of different communication things on the office side. So from here, we made some subtasks of things that we thought we could do that would prove that 90-day retention. So that's our measurement is the 90-day retention rate, number of initial clean complaints, numbers of initials who cancel before the initial which that one is actually about looking out too far. And then our response time. Okay, I'm like, I don't know what just happened. So those are our measurements and then these are our tasks related to that. And then another one for us is scheduling, flexibility and consistency. We are by far the biggest company in our area. We're over double the size of the next biggest company after us. And so we're really in demand. And one of the things that we found is that if we don't keep hiring paste well enough with client demand, then we end up getting really far out. Like on average, I would say most of this year we've been booking more than a month out. So if they call and want a set of cleaning with us, we'll be like, yeah, we can get you in for your initial in four to six weeks. So what we were finding is again with those 90-day retention rates, we had a lot of people that would sign up for service with us and then lock us out of the first clean because it was six weeks later. So we needed to figure out what are we gonna do about that. We also were in the middle of a big role train for a while, which a role train for us is when we're bumping clients off the schedule because we don't have enough room for them. We do have a system for how we handle that so that it doesn't happen to the same people over and over again. But we were starting to have that problem. And then we realized that we were seeing no to almost everyone who asked for accommodation for us. If people called and said, hey, tomorrow's not gonna work for me. Could you get me in on Thursday instead? Our answer was pretty much always, no, I'm sorry, you'll have to wait until your next cleaning because we just didn't have enough staff for it. And we were adding clients so fast that even when we hired people, we would just fill them up and we wouldn't leave that room. So I don't know that I see it in here, but one of the things that we decided is that we're going to always keep four more people hired than that we're not booking, just to fill in those gaps. And then quality consistency, staging, we're starting to notice that there's some gaps between our cleaners and what people are doing from a staging aspect, not necessarily from a cleaning aspect. So we're going to be running a staging contest about that. All sorts of things. I mean, you can see it's just the start of it. But that is kind of the process that we're going through when we see that we have a number we don't like, we're going to go through and be like, okay, but why? I think you gave some good examples. Denny, was that helpful? I feel like she gave you exactly what you were looking for there. Oh, she wants, Denny wants to know, follow up question, what does staging mean? So staging is something that I'm sure you all do, but maybe you don't talk about in a sense, but it's the way that you arrange things, not the way that you clean things. So for example, we really like to do staging for kids. And oh my gosh, I have a quick story to tell you, it killed me, but we love to do staging for kids. So we'll like set up all the little stuffed animals in a ring and then have one reading the book to them and, you know, things like that. And I actually did a comp clean a week ago for a gal who was, she actually worked for me like 10 years ago or something like that. And now she's a mom and she has tons of kids and they care kids and everything. So I did a comp clean for her in exchange for she was going to do some social media posting for us. And so the team goes and they leave and they did a great job, but I'm like, okay, first thing I want you to go take pictures of is kid staging. And she's like, they didn't do that. Do you want me to go do that? I'm like, how does somebody who works for me not staging for the kids?  So that is a really big focus that we tend to put on in my company is staging. All right, let's see. I know that C had some questions too. Yeah, this is a multi-part question. Yeah, you're gonna have to talk for a while here, Laura. I'm glad you're getting some water in you. Okay, are all of your core office crew full-time employees? Yes and no. So typically we have three full-time in our office. We're doing about two and a half million a year right now. Our run rate is actually closer to something else, but we'll do two and a half this year. And so typically doing two and a half million dollars, we would have three full-time people in the office, and then we have a QA who does not work in the office. She works in the field, she floats around does quality checks, she does additional training, and she does clean for us if we're short staffed. So she's not full-time by any means. But typically in the office we have the operations manager, we have the field manager, and we have the sales person who also does recruiting for us, reason being that issue of the hires and the demand not always keeping up, we gave him both so that it's his responsibility to stay staffed enough for the demand he has. So typically those are the three roles that I have. Right now it's a little bit different because we are in transition, my general manager is leaving, and we are promoting our former field manager into general manager, and we brought in a new field manager from the outside. So she's training right now. So currently the field manager, the new GM and the sales person are all full-time, and Aja is working from home, mostly on projects like moving all of my stuff into air table, and she's in the office once or twice a week, but that's a temporary situation. She's leaving at the end of January. So hopefully that answers the question about how many full-time employees they have. As far as how we split up the roles, again sales is also doing marketing and hiring. Our field manager is generally taking care of everything that has to do with the staff. So she manages the trainers, she manages the QA, she handles all client complaints, she handles breakage and damage, she orders all of the supplies. She basically does everything that she needs to do in support of the field. And then the operations manager is effectively me. I mean, not anymore, but it's who I was in my company before I started hiring for that role. So they do all of the things that I would do if I was there. They manage the managers, basically. They manage our numbers, they manage our goals, they manage the other managers. They take escalation calls from clients, but Aja typically doesn't ever really answer the phone unless there's a big problem that someone below her can't handle, which is very often. So, sorry, I stopped reading out dirty questions. So I have the three in the office, the one in the field that's over the field. And then I wanna say that we have like maybe 40, 45 out there. We used to actually have more, but we used to be teams of two and we switched to solos during COVID. And we found that we can clean the same number of houses with a lot less cleaners as solos than as teams. So it's probably closer, like 40 now. And then what is my office company culture like? I mean, I think we're awesome. My people love each other. They love going to work. People always comment that we laugh a lot and loudly in my office. We're kind of rambunctious. And so when people come visit us, we always get comments about that, but we're just a really good solid team. I've cross trained just about everybody on everything. So they have 100% ability to back each other up at all times and they do. So hopefully that answers your question. Sweet. You know, we are kind of getting towards the top of the hour. We have a little bit of time left. This is a lot of information that you're sharing with us. And it looks like you've got a very elaborate system built out in an air table. I know that a lot of folks are probably watching this wondering, gee, that's awesome. I wish I could do that myself or had that. How does one go down that path? Do you want me to tell them the easy way or how they can do it themselves? No. You can get as wide open. Okay. So Ash and I are actually teaching a class on this in January and four columns at our office. It's going to be January 6th, 7th and 8th. So it's just a little over a month from now. I know it's kind of the last minute. But basically, I feel really passionate about sharing this with people because if we hadn't had all of these things in place, then I don't think my company would have made it when I left. And just in case there's anybody on here who doesn't know me and know my story, my daughter has cancer and was diagnosed two years ago. And I basically called my general manager and said, I quit and I've never been back since. I've been completely absentee since then. And I didn't have a choice. She was in the hospital for over a year after her diagnosis. And so I think if I hadn't had all of this stuff in place, that it would have been really hard for my company to make it and through COVID and everything. So I feel really passionate about sharing this with people. So we are holding this conference. It's going to be Ash and I teaching it together and you're going to get all of our stuff and we're going to help you customize it to your company. So you're going to get all of our goal setting stuff and our meeting structure. You're going to get all the things that I showed you. You're going to get our operations manual and we're going to customize that to the way that things are done in your company. Yeah, I didn't need saying. We're already like half full. So hop on it if you want to get it in. But so that's going to be in January and then we actually have a follow-up online in February. And the February can be a follow-up or it can be a standalone. So if you can't come to Colorado in January, you can take the online course and you're going to get all the same content through that time period. It's 10 weeks. So by the end of 10 weeks, you'll have gotten all of the same content that we did in person. But the reason the other kind of part of it is that if you come in person, you can do the online part for no additional charge too. I go to conferences all the time and I get so many ideas and I go home and I don't do it. Or at least that used to be my life, you know? Because I would go and I'd be like, oh my gosh, this is so great. And then you get home and it's like, all this stuff's going on and you never get around to doing it. So the reason that we're doing the online afterwards is both for people who can't come in person, but also it's accountability. We're going to go through it all again online. We're going to give homework. We're going to have open question time every week. So we're going to make sure that you actually get this stuff done. So that's the easiest way to do it is to take mine. You couldn't build it yourself, but I didn't show you guys the operations manual on this call, but just the operations manual itself that we have an air table took Aja, like feel free to chime in here Aja. But I think like 90 hours or something crazy like that. And I actually think that we're still moving some things into it. So I know there's probably some people that aren't real familiar with air table, but that's like a online SaaS product that's kind of a cross between Excel and say some database application. Yeah. And so if I signed up. It's been closed 100 hours on it. She's still not done moving it in the air table with the reason we're moving everything in the air table. I think I said is both cause it's hard to break and also because it's easier to share with other people. So she says a hundred hours just on one of the documents that we're going to be sharing with you. So you will have to have an air table account though. That's a very... So I'm going to, you know, I sign up for your program. I get an air table account, which is relatively inexpensive, I presume, I guess. Do you know how much I... I'm paying $120 a month right now, but I think I have four seats. So I'm thinking it's $30 a seat. And if you don't have a whole bunch of office people, you don't need them any seats. You can do it for as low as about $30 a month. Well, and it's a free version too. And I'm testing it out with my sister tonight to see whether our stuff can be supported through the free version or like kind of what... Oh, Aja says $15 a month per person for low level and $30 a seat for the pro level. So yeah, I'm doing some testing with my sister tonight on the free version, but you will need an air table account. Once you sign up for the class, we will be reaching out probably beginning of next week to everybody who signed up with hotel information, all of that. And then also to get your air table information so that we can start transferring all of our stuff to you. And you're going to get the all star version. So you're going to get my whole operations manual, my whole, all the things, and my whole goal setting spreadsheet. You're going to get all that stuff with my data in it. And then we're going to spend the class going through and revising it for your company. And we're going to cover a lot more stuff other than just the air table stuff. That's just, that's the hugest part of the project. That's four years of Aja and I's work is an air table, but there's going to be a whole lot more than that too. We have a question. Where do we go to get more information? It looks like Aja just put the link down there. Tom, maybe you could copy it over to the other pages. Oh, effort. All right. All right. Also, Laura, I had somebody ask me about, well, what if I went to the Juneau event?  Because didn't they already get all of the stuff on a flash drive? They did get all the things. That will be an overlap. Other than that, a lot of this is going to be different stuff though. And it's not just the stuff though, right? I mean, what I said was the whole point of going is, it's not just the stuff, it's the implementation. It's putting it all into place. A large part of the class is going to be editing the things for your own use. And we're going to go over a lot of goal setting, problem solving, leadership stuff, basically communication stuff, a lot of communication stuff. Basically, I want to give you all of the tools to be able to step out of your own business at a moment's notice, whether that be due to an emergency like I had, or just because you want to step back and work on the stuff that's actually important to move the dial versus just getting caught up in the whirlwind of the day to day. So there will be a lot, and a lot of it will be, yeah, as it says, tangible materials plus theory methods all together. So it's going to truly be more of a workshop. You're going to implement things out of this to help your business run from a stronger base. And another part of this, which I think is unique and new is the material now resides within Airtable which makes it shareable, it makes it a lot more usable. So that alone, I think is a tremendous upgrade. Yeah, versus the thumb drive full of flowers for sure. And another really great thing about Airtable too is everything is trackable, right? So you're able to see who's doing what, who's responsible for what, you're able to have that oversight without having to try and figure out, remember stuff. Everything's right there in a way that you can just see it. So, all right, so today this, for those of you that are on here thinking, what is this just a pitch for Laura's class? It's really not, it's not, it's not a pitch. This whole month we are talking about budgeting and goal setting, but the reason why we wanted, one of the reasons we wanted to bring Laura on is because she does have this program that does fit in exactly with what we're talking about. So- And everything we've done, you can recreate easily also if you wanna do, it's just, it's that hundred hours of work into it or not, but it's all- We're going around a hundred hours just into one form. One form, I know you don't wanna know for all of it. But yeah, the principles are sounding, you don't have to get it for me, so. And quite honestly, it's 2022 for goodness sakes and we're quickly moving in a direction that everything's happening fast and there's no sense in trying to reinvent the wheel and do, I mean, there's years of work and yeah, I mean, we're promoting, we're sharing with your product, we're sharing you with an opportunity, speaking to the audience here, but it is gracious for a lot of us, it is a heck of a lot better option in your next best alternative when it comes to putting together a planning tool. And one more thing, Tom hit on it here too. You know, it is, we're looking at 2022. If you are still doing things the same way that you've been doing them, the way you were doing them five years ago, y'all need to upgrade. You're moving in a direction where you're going out of business and you don't even know it. The world is passing you by. Yeah, and quickly, ever since COVID hit, things have really escalated and there's been a new velocity right here to everything that's going on. So you need to be looking at what do you need to change? What needs to be improved? What needs to be upgraded? And I don't know. You can see that Laura's on the front end of that, trying to figure out ways to make that work in a bigger way, not just here's a new form, here's this form, fill this form in. It's not that. Okay, so for goal setting, because we got one last minute here for goal setting. Bottom line is here we are at the end of the year. You need to be setting your goals for 2022. What? We have a whole month left Liz, 20 a time. But you did hear what Laura said too. She had to do it all in one day with all of those people. Over 30 hours of planning time was put in with all of those different people. Actually, yeah, over 30 hours of planning time was put in to her goal setting. And she's not done yet. You heard her say she's not even done yet, right? So you guys need to jump on it and get going with what are you gonna do for your plan?  And I guess this is actually a plug for the strategic success groups because that's what we do in the strategic success groups is we keep you on track every week toward your goals. I just wanna say all of my managers are in Liz's strategic success groups. All of them, including Asha who's leaving. I mean, every person in my office is in Liz's groups and we love it. It is a huge, huge tool to keep you on track. Keep it on track. It's not easy to stay on track. Things move so fast. So thanks, Laura, sharing all of your stuff. And I know a lot of you guys are out there going, looking at some of that data going, wow, wow. Yeah, CC, all that data in real life in January too. Great investment, great investment. We are at the top of the hour. Laura, this was good stuff, very useful, fun. We love our numbers. So it was good. Yeah, absolutely. Awesome way to kick off a budgeting and goal setting month, but we're not done yet. We're just getting started. We're gonna be back Monday, five o'clock Eastern, two o'clock Pacific. And you guys can figure the rest out from there. Guess who our guest is gonna be Monday, Liz? I do not remember, Tom. Cadmah, oh. Oh, that's right, Cadmah's coming on. She's gonna be talking about budget planning in 2022 and she's been, you know, a guest a couple of times on smart business moves. And if you've seen her before, I don't need to say anything more. I know you're gonna be here.  Well, and if you haven't seen Cadmah before, you need to make sure that you get a nap 30 minutes before the show starts, because she is gonna work your brain out. I know, I know I won't be. Yeah, yeah. All right, y'all. Thanks so much again, Laura. Oh, Laura's frozen. At least she froze. Here you go. Freeze. The internet, at least the internet hugged with you for the last hour here. So. That's right. Thank you so much. Thanks so much. See you there, guys. Have a good week. We'll see you there. Bye-bye. See y'all later. Bye.


What's going on guys got Kyle here with Layton sports cards, and we are ripping. This is one box of the new release 2023 tops athletes unlimited Athletes unlimited good luck. Let's see what we got Good luck. Jayman. This is for Jayman L. I don't know if I said that I don't think I did this one is for Jayman L Good luck, sir. Oh the Kobe Jordan card was sick the East West card. I do like that one a lot There's a being unlimited Brit Reed Look for one auto one one lemon here. Hopefully see some really nice low numbered color as well There's a foil of Amanda Benson Face of the nation Charlotte North Yeah, I like that. I like the there's a couple nice Jordans for sure. There's the Jordan auto Unlimited potential city Watson there The Jordan auto the East West Jordan There was the one Kobe the on-card auto Kobe to Alan was sweet and then there was the triple auto that had Kobe as well A couple really nice cards a bit of Danny Drew's Kayla Wood. Yeah, that was like an exquisite a college exquisite. I think right I Miss I missed a couple of the cases, but I Saw for the most part got a foil of car Carstel up cars to love There's blue foil gonna be Alicia Ocasio to 99 59 and 99. Yeah, that was sweet. That was sweet. I Agree there the Roger Maris bat barrel was very sick too, man That's some that's some history right there. There's another blue foil Ali Kennedy this time It's gonna be to 99 as well eight of 99 and the The Ted Williams cut auto was very cool Ted Williams cut auto trying to think of some other stuff man There was a lot of Lot of really cool hits there There's a foil Natasha cloud Record breakers of Ali Kennedy There's a foil Odyssey Sims the buy-in was 2,200 sc 2,200 219999 the refractor LeBron too. I need to give me one of those tops Chrome rookie refractor. There's record breakers of a Chidester Yeah, I think the next one he said we're gonna be doing a drip exclusive personal Almanac That one will only be about a hundred to a hundred and fifty so a nice lower buy-in So yeah, those will be personal as exclusively about a hundred to a hundred fifties what Lane's aiming for on that Doesn't have an exact date on that one yet, but should be pretty soon honestly Maybe a couple weeks and get that one out It's like our patch is gonna be Danielle O'Toole on the base patch there Let's say game used on the memorabilia Danielle O'Toole. Yeah, that's what I was thinking Steve. It's a nice price, man. It's like It's price where a lot of people definitely will be getting in and it's multi sport as well So the last one we did was the last person we did was baseball only this one will be multi sport so Got a Taylor vanthoff there on the silver on the silver foil There's a throwback there throwback to a tops black gold That is gonna be Tori Valdez or Vidalis on This throwback First one I seen of those. That's pretty sweet. There's a foil of Tina bow. She'd still have an auto coming up here There's a foil Amanda Chajester record breakers of Erica P. M. Castelli record breakers of Bethania Dela Cruz Right five packs left Jamin Good luck. Good luck. There's a face of the nation Kelsey harshman unlimited potential of Rachel Lewis Releth Next up we will have Jason guys with five wwe prisms. Good luck Jason Face of the nation McClain There's a foil of Kyra Pelton Ali a master on eat on the unlimited or the being unlimited and last pack on these are 6499 Brett 6499 it's a new product release There is a foil of Sierra Romero and record breakers of Deja Malipala. All right, Jamin that will do it for your one more box of tops athletes unlimited Thank you so much. We'll get it right out to you


I was going to have to hustle through my slides, so you'll just have to bear with me. The presentation is intended to be reference material. I was going to go through it pretty fast anyways. Google is your friend. If there's something on there, you don't understand. I'm going to try and explain very, you know, 10,000-foot view, but it should be fairly clear if you actually are interested in the topic and want to dig in. You can find all this material, explanations of what they are on the web. It doesn't seem to be working. Oh, sure. Why not? So you're going to have to use a keypad. Okay. I'm John Mahaffey. I actually work for Mentor Graphics. They know the printed materials say I'm from Montevista, but probably you've heard that the mentor has acquired the Montevista Automotive Business Unit. Oh, that's the best way to do this. Here we go. So in 2005, I was the Bobolytics Architect for Montevista, doing a lot of mobile and power and fast boot and security sort of things for mobile phones. After that, I was the Automotive Architect at Montevista. About a year ago, I became the security lead for Genevi, the system infrastructure expert cube. So I'm working with the security team inside Genevi to help define automotive security. This talk is not about automotive security per se. It's more for just general embedded use. As of about a month ago, I became the senior system architect for Mentor Embedded. So this is about embedded systems. It's not about IT security. It's a very different beast. The key piece of IT security is that you have to have physical security. For an embedded device, you don't own the device. So physical security is not possible. In general, you're not protecting Fort Knox, so it's not as big a deal. You know, you don't have billions of dollars worth of data writing on it. If you are protecting Fort Knox, there's a lot more you have to go through. And look up common criteria if you want to see what kind of pain you're in for.  They're going to go for low-hanging fruit. So this is intended to let you be not low-hanging fruit. There's a little joke about a couple of campers who are confronted by an angry bear. And one of the campers sits down and starts tying his shoes. The other camper goes, well, why are you tying your shoes? You can't outrun that bear. He goes, well, I don't have to outrun the bear. I only have to outrun you. You make your system hard to hack, and they'll go after easier things. A quick taxonomy of black hats. Generally, in the security community, they don't call them hackers. They're good hackers and bad hackers, and bad hackers are called black hats. At the lowest level, they're called script kiddies. These are people who really don't know what they're doing. They've found something interesting. Their friend told them about Metasploit or something, and they've tried it out. And wow, they got into somebody's system, and it isn't this cool. And they're easily defended against. They're easily caught. The next level are what we call opportunists. There are people who are maybe insiders who have inside information and possibly an opportunity presents itself for them to use their information, possibly sell it. There are bots scouring the net at all times, looking for vulnerabilities, looking for open ports. That's another type of opportunist. Then there are the grudge hackers. These are people who are probably in the same category as script kiddies. They don't really know what they're doing, but they're motivated. They want to punish the company for laying them off or whatever their grudge is. They're in general. A denial of service attack is fine for them. That's not a profit motive.  Possibly denial of service is what they're after. They don't like Microsoft or they don't like Red Hat or whatever it is. Organized crime. So there's well-funded organizations that create botnets. They actually spend money. If you create a virus and you can create a botnet for them, they will pay you money for your botnet, and then they can sell that to other organized criminals. Then we have the nation states. We all heard about the Chinese government hacking into the United States. Well, there's the United States and Israel hacking into Iran, and there's the Russian government. They call them nation states. Government isn't a broad enough term, apparently. So we'll get into the best practices talk. I'm going to go over some design best practices. It starts at the root of trust. If you can't trust what operating system, if you can't trust your bootloader, then you can't trust it to bring in the right operating system. If you can't trust your operating system, then your applications can't trust that they're going to be doing what you designed them to do. So it all starts with a secure boot. There are many commercial vendors of it. ARM has a trust zone and free-scale and TI, and all the semiconductors, they've got their own versions of secure boot, but it starts with a root of trust. You should, if you're connecting to the Internet in any significant way and communicating things of value, you should have a hardware crypto module. Typically, it would have a cryptographic engine for encrypting and decrypting. You would have some one-time programmable cryptographic keys. Your secret master key. Don't use the same secret master key on every one of your devices. Part of it is, these keys are crackable, and I'll get into that a little bit later, but you don't want one crack key to lead to a class of devices that are compromised. Random number generator is a good thing to have. A lot of the communication protocols require good random numbers. Trusted boot we just talked about. One-time programmable data, things like serial numbers, flags that say what state machine is in, those sorts of things, a monotonic counter so that you can tell if there's a man in the middle trying to spoof your communication. Secure RAM for holding decrypted information that you want to keep secure. Tamper detection to see if the device has been opened or possibly power glitches or over-tamp things to try to pre-fault attacks. Other things are possible. You've got to ask yourself how much are you willing to pay and how valuable is your data, but there's always a compromise. You're going to want to harden your hardware. A lot of you are Linux hackers and believe firmly in the GPLv3, but often that's at odds with a secure device that needs to communicate with a secure infrastructure and is doing monetary type of transactions. By limiting access to the hardware, for instance by potting or using glue instead of screws, those sorts of things, it makes it harder for people to hack your device. Now, I know I love to hack my devices, but this isn't about that. You want to reduce electromagnetic emissions, wrap it in foil, just actually take it and put it on the radio range and see what kind of emissions you've got because the bad guys go out and they've got radios and they can tell what your machine is doing by what it's putting out. Be wary of GPLv3. You don't absolutely have to avoid it, but if you do have GPLv3 code on your machine, you are legally required to accept unverified code from anybody who wants to change your device. If you do accept unverified code, you might want to actually have a one-time programmable modified flag inside your crypto module. That would say, it to your services infrastructure, as a packet comes in that's got the right sign key and everything on it, it would have this flag attached and you would say, I'm sorry, I can't trust that this packet is actually what it says it is. Use Linux security modules. There are a number of them that you can use probably the most well-known of them is SE Linux. SE Linux is very good. It's verified by the NSA, National Security Agency for use in secure machines. It's well supported in most of the Linux infrastructure. It's also the hardest to configure and get it right and getting it right is very important to security. The next level down would be App Armor, which is path-based, whereas SE Linux is iNode-based. One of the problems with embedded systems is a lot of your embedded file systems don't have the extended attributes that are required for SE Linux, whereas a path-based security system, such as App Armor or SMAC, just uses the path to the file rather than the actual iNode for file access verification. SMAC is simplified mandatory access control kernel. It's probably good enough for most applications. It's kind of like flossing your teeth. It doesn't really matter whether you use waxed floss or unwaxed floss. What matters is that you floss. So put in a mandatory access control system. Unfortunately, the three main ones here that I've shown are not compatible with each other. They use the same concepts and the same LSM modules, but their configuration files are not compatible at all. So if you choose one and then have to switch to another, it's sort of like starting over from a configuration standpoint. There are others to Mojolinux, and there's probably a dozen of them. Linux containers. There was a talk yesterday about namespaces in Linux containers. So if you want to look at Jake Edge's talk, it was pretty good material. You should plan in the design phase for field updates. If you're connecting to the Internet, you're probably going to have issues at some point with something that you didn't get quite right. And if you plan for field updating up front, then it's not too painful for you. You have a question of push versus pull, but that's a policy decision. Push stuff out to the device, or do you want to require users to say, yes, go ahead and give me the latest security? Protect your data. In security circles, they have two forms of data. We have data at rest, which is the data that's actually on your device, how it got there is not relevant. And for sensitive data, such as address books or musical or video content, you can use an encrypted file system such as eCryptFS, but you don't want your device to fall in the wrong hands and have easy access to those sorts of sensitive data. And then there's data in motion, things that come into your device, either from a USB stick or over the network, or however you access your infrastructure providers. Use secure socket layers, transport level security, which is the successor to secure socket layers. IPsec, these are all users of random numbers, so you've got to keep your entropy up to use these. If you don't have enough good entropy in your system, these communication mechanisms will slow way down, something to be aware of. Development best practices, this is kind of like programming 101, but it works. Peer reviews, do them. People are proud of their work, and they're not going to put something out there for other people to look at and criticize if it's not good. So this forces you to do your best job creating the code. Put comments in your code. I know it's hard for people to do that. The code is definitely the last resort. What it does is what the code is written, but if the comments are not there at all, it's very hard to review and it's very hard to modify, and that becomes a source of vulnerabilities. Use coding standards. There's Linux coding standard. Every large corporation has their own coding standard. It doesn't really matter what the coding standard is, but if you use it and everybody uses it, then it's a lot easier to follow the code as you start going through unfamiliar code. Basic stuff. Simplicity. There's power in simplicity. You want to keep your routine small and simple and easy to understand and easy to use. Quote from Wikipedia in the vulnerability section that a large source of vulnerabilities is constructs in programming languages, whatever your language is, and not necessarily just C. If they're hard to use, then people will use them incorrectly, and that will create holes for hackers to exploit. Randomize. A lot of the PACS project has had a number of things accepted into mainline. Address-based layout randomization. There are others. They've done some things with vinytils to help harden programs. You know, go out to the PACS website and look at it. As I mentioned, keep your entropy up. Enroll IRQs that are based on random events, such as keyboards and networking events and so on. Don't enroll your tick. It's not random. There was an interesting project called HAVGED that it created entropy out of the variations in cache, you know, how the access patterns in cache change, and it actually turned out to be a good source of entropy. Don't mess with the PACS penguin. Test your system. It's basic stuff. You need to plan. Have a QA plan. Write it down. Test your error paths. So a lot of code is tested in the main, but you end up not really covering a lot of unusual conditions. And you can bet that a hacker who's trying to penetrate your system, he's going to start typing with his left elbow and, you know, spin in circles and do random things, and if you see something unusual, he's going to say, oh, okay, well, let's do that again.  Do coverage analysis. See how good your test coverage is. GCOG is a good tool there, pretty cool. If I'm going too fast, let me know. I'm not sure what my time left is. Got about 15 minutes. There are a lot of static analysis tools that are available, both free and for pay. Your primary first line of defense should be the compiler. It's basic. There are flags you can set in your compiler, WFormat and WFormat Security, that will check your format strings for vulnerabilities. One of the basic vulnerabilities is if you don't have a format statement in your input, then somebody can put in a percent S as part of their input, and the library will interpret that as a format. That's how one of the ways that malicious code gets injected into your system. Obviously, check your inputs, make sure they're in bounds. Those sorts of things are all pretty basic. The compiler has FStackProtector, which can put canaries in your stack and detect stack smashing attacks and create an error if it detects a stack overflow. Define fortify source. That will put in checks for your buffers, for buffer overflow attacks. Wikipedia, the Google and the network are your friend. There's a list of tools for static code analysis on the wiki. It's very extensive. There's just a few. There's your basic lint and java lint and pylint and so on. You've got the bash checker, so your skip checker, the C-language checker, YASCA, which is a security checking framework that has plugable modules. There's quite a few for pay static analysis tools from Blackduck and Coverity, Clockwork, Rational and others. Depending on your financing and the level of management support that you get, those are all good tools as well. There are dynamic analysis tools. For memory management, you've got Demalik, Electric Fence, Mtrace, Mpatrol. Valgrind is a very good tool. It's an emulator that emulates your machine. Of course, as an emulator, your hardware might perhaps do things that are not anticipated by Valgrind, so it's not guaranteed to find everything, but it's a very good way to get a lot of data about what your program is doing, and if you examine the output, you might find things that you didn't expect. Avalanche, Glassbox, G-Perf tools, JRATs. Some of these are performance analyzers. Some are for security vulnerabilities. Again, the commercial ones, Purify and Rational, both have dynamic analysis tools. Avalanche is an interesting one. It tries to create inputs and find error paths, and so it creates files that it calls the input of depth. So when it finds an input combination that crashes your program, it'll save it off for you, and it actually goes in and branches out and finds lots of interesting things. It's an automated testing tool.   Limit as much access as you can. Remove all the debug and the hacks that you put in so it makes it easier to get into your system and test it. That all needs to be removed before you deploy. Don't assume obscurity will protect you. Obscurity by obscurity is well proven not to work. Run the tools that hackers use.  Run Metasploit or the GUI version called Armitage. These are free tools. The hackers are using them. Don the Ripper, check your passwords. Not all devices have passwords, but if you do, these are good things to do. There are many, many more tools. Any good security site will have a bunch of those that you can use. Hire a professional.  A hacker that can possibly either go in cold, which costs you more money, or you can tell him this is what my system does and this is how it does it. Can you get in? They will often find a way. That gives you more information on what to close. This month, earlier, a few weeks ago, security researchers found a hack into the file for industrial control system that's used by military hospitals, factories that does surveillance and alarms and door locks. What a great thing for spy. All I can do is do this hack and I can get into your building and you don't even know it. The interesting thing was, the company last year, late last year, said it believed attacks on that system were unlikely because the systems were obscure and hackers don't traditionally target this. That was probably like waving a red flag in front of a bull. The lesson is clear, I think. Do not rely on obscurity. Hackers will come in and they'll find their way in and you won't know about it until something bad happens because of it. That's what's called the window of vulnerability. From the time that they find it until the time that you find out about it is called zero day. It's a very difficult problem. Every system has faults. Perfection is not possible. Don't count on your system being perfect when you ship it. You need to follow the lists. There's quite a few. The National Vulnerability Database at NIST puts out, exploitdb.com, securitytracker.com. Those are all real good resources for finding problems. You need to analyze them, of course, and say, does this issue apply to my system? But if it does, you need to deploy your fixes proactively. You or the distro that you base on should be following CVEs and providing fixes. The security community reports vulnerabilities when they're found to cve.mitre.org. Generally, MITRE will embargo the actual details for a period of time, maybe a week or maybe a little bit more depending, to give the distributions time to come up with a fix for it. So the distros actually have access to that information. I guess if you work for a big enough company, you probably have access to that as well. Another good source of information, ossecurity.openwall.org has a security wiki for Linux. It's got a lot of really good information on it. So a little bit about attacks. So we have timing attacks, which is a crypto module, a cryptographic algorithm. It takes a various amount of time, depending on, for instance, the number of ones in the key. And so by checking how long does it take to encrypt a certain clear text, it will leak information about your keys. So the more information that a hacker can get about your key, the closer he is to cracking it. There are fault attacks. So you can induce faults in computers. It's well known. Alpha particles. You can induce eddy currents using electromagnets. You can heat it up. Semiconductors don't work well at high temperatures. The RSA algorithm, if you have a certain ciphertext with a known good output, a certain clear text with a known ciphertext output, and then you can induce a fault in that that gives you a different ciphertext output. And a few of those, and you can actually crack the key. Just a few. It doesn't take many. Similar to timing attacks, you can power analysis. The algorithms use different amounts of power based on the key and the clear text. Port scans. There are lots of ports, and there are bots out there scanning ports all the time. There are denial of service attacks where you don't really care if you compromise your system. You just keep it from doing any useful work. And then escalation of privilege attacks. The defense. For timing attacks, you need to either randomize, you know, put some random things into your encryption algorithm or standardize your timing so that everything takes about the same amount of time, regardless of the input. For fault attacks, tamper detection module is a good thing. It can detect physical. Did somebody dissolve the cap on the SOC? Did somebody glitching your power or your clock? Radiation, things like ions and alpha particles and, you know, even photons. You can put detectors in that will detect such things. Temperature, over-tamp conditions, anti-currents, these are all possible to detect. You know, if you've got enough money, you can put lots of things in there. With enough money, redundancy is a good check against a fault attack. If you have two parallel pieces that are doing the same thing and they come up with the same result, there's a good chance that it hasn't been tampered with. Power analysis attacks. Again, randomization inside your crypto module. Port scans. Just close your ports.  Denial of service attacks. Use things like C-groups and quotas to keep runaway programs. It doesn't even have to be malicious. Programs sometimes get runaway just because they have a bug in them. By limiting the amount of CPU or the amount of disk space or various resources that they use, that lets you limit the denial of service. And to combat escalation of privilege attacks. Mandatory access control systems. Use containers. Illytic containers or, in other words, name spaces for that. What am I doing on time? I'm just about out. You want to give me another five minutes and I'll go real quick through this. This is the kind of things that is more in line with information security systems and for high value things such as automobiles, EV systems, things like that. You have your CIA triad. I just thought it was a cool graphic. But confidentiality, integrity, and availability are the three cornerstones of information security. We use a security methodology. You start out by defining what are your assets? What are you protecting? What is key on your system to protect? And then you define the threats to those assets. And that helps to define your security strategy. And then you take those threats and you categorize them using... There's a Microsoft methodology called Stride and Dread. And Geneva is using the TVRA method, threat, vulnerability, and risk analysis from the European Telecommunication Standards Institute. Stride stands for the various categories, spoofing, tampering, repudiation, information disclosure, denial of service, and escalation of privilege. Dread is what you use to categorize the effect of a vulnerability. What is the potential for damage? How reproducible is it? If you can reproduce it, how exploitable is it? How many users are affected by it? It's one versus everybody. And how discoverable is it? How obscure is it? So the typical method would be a sign of value between 0 and 5 for each of these, 0 and 10 for each of these. Add them up and divide by 5. So the Geneva Automotive Consortium uses the ETSI TVRA method, which is similar to Stride and Dread. There's a little bit of alternative. So I can go over that. I was going to show an example of some of the categorization that we had in Geneva, but it's on my other laptop. So questions. Now this talk, I uploaded a prior version of it for the website, so this exact talk is not there. I'm assuming they'll let me upload this one post after the conference, but if anybody really wants a copy of this, just drop me a business card and I'll send you a copy. I'm also going to upload it to the Geneva site if you have access to that. Sorry, it's kind of like drinking from a fire hose. As I said, I intended this to be sort of a reference material for people who want to dig deeper. Certainly if you have questions, feel free to contact me. And if there are no questions for the broader group, then thank you very much for your attention.


Okay, so this is your foot You've got two bones here in the back the talus and calcaneus heel bone kind of ankle bone you've got so in the hand we had Carples in the foot we have Tarsals with the T Followed by the long bones here are your meta tarsals and then the toes are still called phalanges Remember you have a distal medial and proximal


Ευχαριστώ και καλώς ήρθατε back. Είμαι Βικη και είμαι εδώ με ένα καλύτερο πρόγραμμα σήμερα. Θα θα κάνω ένα πολύ ρεαλίστικο σούκουλεντ. Είχα δημιουργήσει ένα φωτογραφείο της σούκουλεντς που δημιουργήσαμε λίγο από τη σοσιαλμίδια μου και όλοι είχαν εξέγραφη για ένα βίντεο, οπότε εδώ πάμε. Πρώτα από όλοι είχα δημιουργήσει αυτή από να χρησιμοποιήσει ένα σιζιξιξιξιξιξιξιξι. Τώρα, το σιζιξιξιξι έχει δύο διβιζιντς, ένα στην Ελλάδα και ένας στην Ιωσία. Και κάποιες της δημιουργίες δεν είναι αυτοί σε δυνατές δυνατές. Αλλά οι δυνατές έχουν δημιουργήσεις που είναι πολύ σημιλές στο σιζιξιξιξιξιξι. Και θα κάνω σωστά να πω κάτω από εσένα στην εξέγραφη. Το σιζιξιξιξιξι που χρησιμοποιήσαμε όπως και πιο δημιουργίες από το σιζιξιξιξιξιξιξιξιξιξιξιξιξι. Αμrade, θα πω πως εσού επίσης ότι η κοδελιτη慢 φ parental σαν optic... ... συνεχώς την Xiao, έγινε δίσθηση... ... κανείς λεπτ casualties και η κοδελιτη ιστακτοπίση... ... που είναι την φωνή του λεπτάου το σικό σπί дело που συνόχAngelάμε... ... στη clicks awesome. Οπότε παίξεψατε πανικό το είπατε, θ hostile σανabi γ αιτρίες δ leurs. Υπήρχεσαν λεπ drawer έλεγα πλάφο ναănριπίζονται εμφιά του εντatha. Θέλω να δείξειaged partly των τιθωνησ크ς για θα πωπρά. τα σχέδια είναι λίγο σχεδικές, they look like σχεδικές και they are different in size and I repeated the same process two more times until I had six from each shape now I'm going to use my blending tool and I'm going to ink up all the edges from all those shapes that I have I am using distress oxide ink and that's seedless preserved if you don't have distress oxides you can use of course distress ink or any other ink for that matter that looks similar to this color Inking up these edges is going to give a realistic look on the finished project it might be a little bit time-consuming but it's really worth the effort at the end and with the magic of video editing I have all my cutouts ready to go now I'm going to use a tool from the paper sculpting kit and I'm using the one with the two balls on each end and I'm also going to use the squishy pad I'm working at the back of my cutout where it's not inked and I'm going all around the edges with the small ball this is going to break the fibers and it's going to turn those edges a little bit curled so they don't stick so flat as they were when I cut them out once I do that with all the edges all around I'm going to turn it on the other side and press at the middle and I'm going to repeat the same process for every one of those cutouts Again this is a little bit time-consuming but it does worth the effort at the end after all this is a succulent that I created to decorate my craft room I have placed it on top of a small pot it really looks adorable and when you look at it from far away you think it's a real succulent but I'm not able to kill it now the smaller you go the faster it goes so you can see how those small ones turn dimensional super quickly turn them around and press at the middle and you can use as many of those cutouts as you like for your succulents you can make them as big as you want to and as fluffy as you want you can really be very creative use different colors of green use aquas and you can create many of them and even put them in a basket they will look beautiful now I'm starting with the center of my plant I'm going to take one of the smallest ones and cut out all the leaves so I end up having three little ones which I am going to fold at the center like so and then I'm going to add a dot of hot glue and stick to those leaves together I am forming the center of my succulent now I'm going to add one more dot on the third leaf and stick all three of those together now I'm going to move on to the rest of the small cutouts and I'm going to add a dot at the center and then stick inside that little thing that I have created in the beginning and I will move on in the same manner adding a dot at the center and then sticking the rest of it on top now make sure that every time you stick a new layer you stick it a little bit offset so no leaves are one on top of another this way it's going to look more realistic and it's going to look fluffier and more full once I've finished with all the small ones I'm going to move on to the second size again doing the exact same thing and every time I stick a new cutout I always offset the petals it's pretty easy and once you make one you if you will find that it is addictive you will want to make lots and lots of them and again you can add as many leaves from each size as you like it doesn't have to be so many as the one I did every now and then you can use your fingers to manipulate all those leaves and you can then continue to the next layers you can also stop here without adding the next sizes so you will end up with a small succulent which is great if you want to create a little arrangement in this case to make it look interesting make sure that you vary the colors of the papers as well as the sizes so finally I have moved to the larger size of the cutouts and I have found it easier to work backwards as you can see just because it was easier for me to see if I'm offsetting the leaves and again use your fingers to manipulate the finished project and your little plant is ready to display it was a lot of fun to create it and I know there are more of those succulents in my future I hope I have inspired you today to create some fun paper flowers to decorate your craft room thank you all so much for watching and I hope you have a lovely day


So, this is a demonstration, a detailed demonstration of the structures which are located in the entire anterior abdominal wall. So, let us start with the most superficial structure after we have reflected the skin. This is the superficial fascia. The abdominal wall has got two layers, the outer fatty layer most of which has been removed and that is called the camper's fascia. And just deep to that is this layer which we can see. This is the membranous scarpus fascia which also we have reflected. What we see in front of this is the abdominal wall with the fascia removed. So, let us start off with the three flat muscles of the abdomen. The first muscle that we see here, this is the external oblique muscle. This is on the right side of the cadabra. We have done a detailed dissection on the right side and we can see that the direction of fibers are running down and medially like this. It is like as if the hands are in the pocket. So, this is the external oblique muscle. It takes origin from the fifth to the twelfth ribs and it also takes origin from the outer limb of the iliac crest. And the fibers medially they form part of the rectus sheet which I am going to describe a little later and inferiorly the fibers they form the eponeurosis forms this structure here. This is a very important structure it is called the incvinal ligament. It extends from the anterior superior iliac spine and ends at the pubic tubercle. So this is the extent of the external oblique eponeurosis. So the proximal portion of the muscle is fleshy and the medial and the inferior portion is eponeurotic as we can see very clearly here. Now we have split open the external oblique muscle and I am reflecting it now. And once I reflect it we can see much more clearly the incvinal ligament. And this is my finger is running along the incvinal ligament which is the inferior free upturned margin of the eponeurosis of the external oblique. And this is the anterior superior iliac spine here and this is the pubic tubercle here. So this is the full extent of the incvinal ligament. Having reflected the external oblique both laterally and medially we see the next muscle and this is the internal oblique muscle. The internal oblique muscle has got fibres which are in the opposite direction. The fibres are running upwards and medially. So this is like as if the patient has got his hands crossed and over to the opposite side of the chest like that. So this is however if you look further lower down we notice that the fibres are not directed upward and medially they are instead directed downwards and medially. But the bulk of the fibres are directed upwards and medially. So this is the internal oblique muscle. This one takes origin from the middle lip of the iliac crest and it also takes origin from the lateral half of the incvinal ligament. Therefore it also forms part of the anterior wall of the incvinal canal which I have mentioned just now. And the fibres then go medially and they also help to form the rectus sheath which I have described and they get inserted onto also the 10th and 11th and 12th ribs. So this is the internal oblique. Now I am going to reflect the internal oblique. I am reflecting the medial half of the internal oblique and I am reflecting the lateral half of the internal oblique. And once we reflect it we see the third muscle of the abdomen and this is the transversus abdominis. And this also we notice the fibres are running transversely that is what is called transverse abdominis. Just like the other two muscles, medially they become aponeurotic. The point to be noted here is that we notice numerous nerves running along with arteries. Neurovascular structures are running. This is the neurovascular plane that is the plane between the second layer of muscle internally oblique and the third layer of muscle the transversus abdominis. The transversus abdominis also takes origin from the inner lip of the iliac crest and it also takes origin from the lower ribs and it also takes origin from the lateral one fourth of the inguinal ligament and the fibres then converge medially and they become aponeurotic and they also helps to form the rectus sheath which I am going to describe just now. So this is the these are the three flat muscles. What are the functions of these three flat muscles of the abdomen? They help to maintain the interabdominal pressure. They maintain the tone and they help to contain the abdominal contents in place. And whenever we do any maneuver to increase the interabdominal pressure like for example coughing, sneezing or straining at maturation or defecation it is these muscles which are responsible. And the nerve supply of these muscles is the thoracoabdominal nerves and we can see the thoracoabdominal nerves here. We can see some of them. As I told you they run in the neurovascular plane. The thoracoabdominal nerves are T7 to 11 and the subcostal nerve T12 which run from the intercostal and the abdominal supply the abdomen. So therefore above the umbilicus which is here is T789 at the level of the umbilicus is T10 and below the umbilicus till the inguinal ligament is T11 and 12 and below that of course is the inguinal. So this is the quick nerve supply and the function of the flat muscles of the abdomen. Finally, a few quick words about some abdominal incisions that are done in surgery. Nowadays most of the elective surgeries that are performed are by laparoscopy. However, there are some indications when we do have to do open up the abdomen which is known as laparotomy and that is when there is a failed laparoscopic surgery or when there is a penetrating your open blood trauma with internal injury or when there is cancer or when there is generalized peritonitis these are some of the situations when we do have to open up the abdomen. So what are the incisions that we make? The quickest is the midline incision through the linealba it can be super umbilical inframilical. This gives very rapid approach. The thing about incision in the linealba is that when we closing it because the linealba is relatively abascular we have to close it with non-absorbable material. I personally prefer nylon loop and that gives a very strong repair. I have seen people repairing with absorbable material and the patient comes back with an incision hernia one year later. Another incision is a paramedic incision that is just like we have done here split open the anterior rectus sheath retract the rectus abdominis laterally because the nerves are coming from the lateral aspect. So we do not rectate immediately we retract them laterally and then we split the posterior rectus sheath and we can enter the abdomen. So this is the paramedic incision again right left super umbilical inframilical. Some places some surgeons prefer an incision by the side of the rectus abdominis and this line which we said was a c-lineal seminary and that incision which is not very commonly used is referred to as the battles pararectal incision. So this is another incision that is used in children when we are doing a surgery for the abdomen and do a laparotomy we do not use vertical incisions we use super umbilical horizontal incision because it is it gives much better access and it is much easier to repair and when we repair we repair all the three layers of the abdominal muscles together. Few special incisions are also used especially if there is a failed laparoscopy and one of them is an incision parallel to the right subcostal margin and that is known as a cocker's incision which is used for the right lobe of the liver and especially for the gallbladder. We have an incision for appendix and that incision is referred to as McBernie's grid iron incision and that is done in the case of appendicectomy when we cannot do it by laparoscopy procedure. The landmarks for that incision is if this is the anterior superior spine and this is the umbilicus we draw a line that is called the spinal umbilical line and we take the junction between the lateral one third and the medial two thirds so approximately at this location we cut the external oblique and then we do not cut the rest of the muscle we just split the fibers the next muscle that we see here is the internal oblique and what we have done here is we have actually split it and then what we see underneath will be the transverse abdominis then we split that and we can enter and we reach the cecum and appendix this incision is referred to as the McBernie's grid iron incision and last but not the least in females when we have to do a caesarean section we do an incision parallel to the just above the pubic bone here like this and we incise and then we separate the two rectus muscles and then we split open the fascia transversalis and the pediatral peritoneum and we can reach the pelvis so this incision is not visible because it is below the line of the bikini that's why in common parlance it is referred to as a bikini incision but technically it is referred to as the fannin steel incision or the suprapubic incision so these are some of the incisions that we do one more thing I wanted to mention is something called incisional hernias and other hernias I already mentioned about the incisional hernia in the region of the linear alba if it is not repaired properly incisional hernia can occur anywhere if it is not been repaired properly and there's a muscle weakness or the nerve has been cut we can have hernia coming out through the umbilicus and that is not very uncommon in children that is the umbilical hernia in 93% of cases the umbilical hernia children closes by one year of age so it does not require any surgery only 7% of them require surgery and that has to be repaired in adults the hernia does not come out through the umbilicus it comes by the side of the umbilicus usually above the umbilicus just above it is known as parambilical hernia this difference is very important and umbilical hernia is common in children parambilical hernia occurs in adults in umbilical hernia the her umbilicus is at the apex of the hernia sag in parambilical hernia the umbilicus is at the wall of the umbilical sag so that occurs only in parambilical occurs only in adults in many thin world individuals we can see a gap between the superior rectus above the umbilicus and especially when you lift up the head from the bed without using their hands you'll see a bulge that is referred to as a dive adication of recti which is usually common commonly seen in the upper part of the abdomen so these are some of the institutional and other ventral hernias that we can get in the abdominal wall depending on what situation it is so that is all for now thank you very much for watching if you have any questions or comments please put them in the comment section below dr. Sanjay Sanyas signing out have a nice day