The initial topic I want to just introduce to some terminology and some very basic concepts of what do we mean by security. Security in terms of computer systems and computer networks. Some definitions taken from different sources, so different people's view of what is security. What is computer security? The protection afforded to an automated information system in order to attain the applicable objectives of preserving integrity, availability and confidentiality of information system resources. So there's a definition from some standards organisation of what they define as computer security. Protecting information systems, computer systems, systems that store and maintain information with objectives of preserving something called integrity, availability and confidentiality. We'll describe, we'll see those words come up more throughout this topic and other topics. Integrity is making sure that information, one example is making sure information is not modified. When we have stored some information on a computer system someone should not be able to change that information without it being noticed, especially in a malicious manner. Availability when we have a computer system it's built and designed for some purpose usually to be used by some users. Availability is making sure that that system is available to the users to use in its normal intended purpose. A problem would be if that system becomes unavailable and the normal users cannot use it. That would be considered some attack on the computer security. Confidentiality is making sure that the information on the system can only be accessed by the intended people. That is, unintended people cannot see the information that should be hidden, it should be confidential. That is about computer security. More specific about network and internet security, so computer security may be the security of my laptop, it doesn't have to be related to a computer network, the security of information on a single computer but nowadays we're often dealing with networks. It's not just a single computer that we care about, we usually store and manage information on many computers. In a business you can think of the information for that business to be managed by multiple computers and they connect it in some network. Network and internet security, and this comes from the textbook, measures to deter, prevent, detect and correct security violations that involve transmission of information. Because we're talking about a network or an internet, we're talking about sending information across the network, transmitting information and the security is the techniques or the things that we have available to deter security violations, that is stop people from starting some attack that violates the security of the information, violates the confidentiality, the availability, the integrity, prevent them from doing performing attacks, if someone is doing something bad on the network, detect that they're doing it and if we can detect something we may be able to correct it and stop them from doing it in advance. So some very general definitions of computer and network security. Those three terms here, integrity, availability and confidentiality are considered key parts of system security, where we've said confidentiality, making sure the information is private, confidential, secret, integrity, making sure the information cannot be changed without being noticed. Availability, making sure the data and system is available to the normal users. If we build a computer for all the students to use, it's not very good if some security attack performs such that the students cannot log in. So we make sure the system is available. We'll see the other terms come up when we talk about security, authenticity, making sure the information and the users are authentic, for example the real people or people are who they say they are, and accountability, especially in businesses, making sure that we can keep track of who's doing what, who's accountable for different actions. We'll give some more clearer definitions and examples of these three terms in a moment. If you want to provide security for a computer or a network system, imagine some organization, a business, SIT. What happens if the computer or network system, the security of that system is breached and attack is performed and it's no longer secure? What are the consequences or potential consequences? What happens if someone gets into the SIT network and accesses the database of student records? What happens if in a company someone accesses information about the trade secrets or private information of that company or modifies that information? Some of the things that can happen or the consequences for a business or an organization is that the operations of that organization are reduced, the effectiveness are reduced. An example may be SIT has an IT server and that IT server is intended for students to use for different courses, for Moodle, for running commands on that server. It hosts a website, it hosts some email lists as well. If, for example, some malicious user could get access to that server and stop it from working correctly, how would that affect SIT? Well, SIT would not be effective or would not be fully effective in performing its normal operation. Students would no longer be able to use Moodle. You may think that's a good thing, but that's a bad thing in that we cannot do our normal operations of providing a service to students. So one consequence of a security breach may be that the operations of that organization are reduced. We cannot work as well as we should be able to. That's a small thing in some cases. Maybe if our server is compromised then I need to spend a day to fix that server and that means it's a day less that I can spend on teaching or on research, so my effectiveness is reduced if there's some breach. Another thing may be financial loss. If a computer system is breached then that organization may lose money because of that. Amazon, for example, Amazon is a company that has a website and many other systems and they make money by selling things through the website. If someone can attack that website, Amazon's website, and stop it from working for even one hour during the day, Amazon will lose a lot of money because they get money on a regular basis through that people accessing that website. So a security attack on some computer system can lead to a financial loss. That's not good. There may be physical damage to assets, to hardware and other systems in some cases. So the security of a control system for controlling a factory, for example, then if someone can break into that and cause the robots and the objects in the factory, the conveyor belts to do the wrong thing, then something may happen inside the factory and objects will collide and we get damage to objects or assets of that company. That's another consequence of a breach. In some cases there may be harm to individuals, physical harm. For example, the security of a nuclear facility, if someone can compromise the security and cause a shutdown of the nuclear reactor and that may cause harm to individuals working there in the surrounding area. So there can be significant consequences of security breaches. And the levels of impact may change. There may be small, that is we may lose a small amount of money or we may lose millions of dollars. So there are different organisations that have tried to measure and tried to develop ways to measure the level of impact so you can determine how much effort you put in to try and prevent it from happening. The larger the consequence and the larger the significance of that consequence, then the more important it is that you prevent it from happening so you don't lose money so there's no harm to individuals. To design a computer system or a computer network that is secure, what do you do? Well people have tried to come up with methodologies that others can follow such that when they design a system it will be secure. OSI, you may have heard of OSI last semester when we talked about the layered stacks we went through a five layer stack. OSI is a set of standards which defines standards for data communications including standards for security, communication security. And there's an architecture defined by them that tries to define the ways for securing systems. We're not going to go through that architecture, we're just going to pull some terminology from it and use that terminology through the course. There's defined by ITU, that's a standards organisation, there's this X800 security architecture. It defines a set of ways to provide security to define the requirements and approaches for satisfying those requirements. That is for an organisation or a computer network, what do you require in terms of security and what techniques do you have available to implement that security? Let's just look at some of the terminology that comes from that architecture. There are different aspects that are defined in this architecture, three of them. Security attacks, security mechanisms and security services. We'll go through each of those and list the key types of attacks, key mechanisms available and the security services that we want to provide. Some terminology that we may use or come from the architecture, a threat is a potential violation of security. Something that can potentially happen is considered a threat. An attack is an actual assault on a system, so a threat is something that may happen. We want to identify what the threats are so that attacks do not occur. An attack is something that happens, it's just some terminology. Let's look at what do we mean by a security attack, mechanism and service, which will be the main focus or the main thing that you want to get out of this lecture. A security attack. Any action that attempts to compromise the security of information or facilities. We have information stored on a computer system, we have facilities, we have the hardware and software in that computer system. Some actions that attempt to compromise the security of that information or facilities is considered an attack, a security attack. As we saw before, a threat is a potential violation. An attack is some actions that violates. A security mechanism, a method or a set of methods for preventing, detecting or recovering from an attack. So if we have threats which may become attacks on a security system, firstly we'd like to prevent attacks. We don't want them to happen, that's the best approach. But sometimes we cannot prevent attacks and it's naive to assume that you can prevent all attacks on a computer system. So the other thing to do is to detect attacks happening. If I want to make my laptop secure when it's connected to the internet so that no one can access the exam answers on my laptop. I try my best to prevent attacks by configuring the software that runs on it, using special software to prevent attacks. But I'm not 100% sure or certain that I can prevent all attacks. Well another thing I may want to do is to have something that will be able to detect when an attack does happen. If I could detect that someone has accessed my computer who shouldn't, then I may be able to respond and recover from that. I may be able to pull out the cables so that no one has network access. Or maybe I'll turn off the computer in this simple example. So detecting attacks is also useful. And to some extent if I can detect attacks very well, it's unlikely if someone knows that I can detect them attacking me, then it's unlikely they'll perform an attack. If you as students know that I'll be able to detect if you try and access the exams on my computer, then you're unlikely to try and access those exams because you know if I detect that you can, then you'll get other punishment. So being able to detect attacks is also a way to prevent future attacks. And if we can detect, we'd like to be able to recover, fix things or prevent the attack in the future. So the mechanisms are the things that allow us to prevent, detect and recover from attacks. A security service uses the different mechanisms we have available to enhance the security of our information facilities. So we stop attacks. So they're related with each other. Let's go through those three, giving examples or lists of each. So attacks, classify types of attacks, general types of attacks, then list the main security services and then the main security mechanisms we have available. Attacks on a computer or network system, we can classify into two different types, passive and active. A passive attack does not affect the system resources. When we say a system here, let's say a computer network or a single computer, if we talk about computer security, but the network or computer that we're trying to protect. A passive attack does not affect the system resources, whereas an active attack does affect and alter the system's resources and operation. The difference between the two will make sense as we, after we go through specific types of attacks, it'll become clearer. So we'll return to this slide after we go through some of the types. Because with passive attacks, there are two main types. Releasing the message context or traffic analysis. And with active attacks, four types that we'll go through. And we use this example scenario to illustrate those six types of attacks. Here's a network or a communication system. There are two normal users in this case, Bob and Alice. So they're using some computer on the network. There's some communications network. And Bob and Alice communicate with each other across some network. And we're going to have a third user in this case, Darth.  An illustration of the attack of releasing the message contents. Bob sends messages to Alice, for example, in the normal operation. Alice is the secretary in the school. Bob is a lecturer. Bob creates exams. Sends the exams to the secretary to print them for the students. So Bob has sent an exam to Alice. And Alice is going to print that. Darth is a student who's taking the subject of the exam that's just been sent. When Bob sends the message to Alice, Bob wants to make sure that no one else can see the contents of that message. If this third user, Darth, can read the contents of the message that Bob sent to Alice, then this malicious user has performed an attack on the system. If I send an exam to the secretary across the network and a student can intercept that, can receive a copy of that message, and see the contents of the exam, then my system is not secure, because the exam should be confidential. So that's a simple case and the most obvious form of a security attack. That is someone seeing the contents of a message that they should not be able to. Releasing the contents of the message. We'll see that the primary way to stop that from happening is to use encryption. Bob creates an exam, encrypts that exam using some algorithm, sends it across the network to the secretary to print. The secretary, Alice, has a special key such that she can decrypt the exam and get the original copy and print it. Whereas Darth, the student, even though they may receive the message, they can intercept the message in the network, they see the encrypted message. Because they don't have the key, they cannot decrypt and get the original contents of that message. So by applying encryption, we can prevent such attacks from happening. So the attack is the ability to release the message contents. It's a passive attack in that, assume there's no attack. Assume Darth is not there. Then what happens? Bob sends a message. Alice receives that message. That's assuming no attack. Now assume that the attack takes place. From the perspective of Bob and Alice, the normal users, nothing has changed. Bob sends a message. Alice receives a message. From the normal operation of the system, when the attack occurs, nothing changes. The system resources do not change. Bob still sends one message. Alice still receives one message. That's considered a passive attack because by performing the attack from the perspective of Bob and Alice, nothing has changed. Alice still receives the message, but it also turns out Darth receives the message. We said, or I said that in this case one, the main way to stop this attack is to encrypt the information. Bob encrypts it before he sends it so that anyone who can intercept and receive a copy see something but they do not see the original message. They see an encrypted form and they cannot get the original contents back. Traffic analysis is an attack where even if we use encryption, some malicious user, Darth in this case, may still be able to get some useful information about what's happening. Let's say, what's an example? Alice is married. Alice is married to Darth in this case, okay? And Alice has told Darth that happily in love, everything's fine, but turns out that someone's sending messages to Alice late at night. 2 a.m., someone's sending a lot of messages to Alice when Alice told her husband, Darth, that I'm at home at sleep at 2 a.m., nothing's happening. Bob, who's sending those messages to Alice, is encrypting those messages. If there was no encryption, what Darth could do would read those messages and find out what's happening between the two. But if there's encryption, then what can happen is that Bob sends messages to Alice, they encrypt it. Darth can intercept those messages, but cannot see the contents. He doesn't know what Bob is saying to Alice, but he does know that Bob is sending messages to Alice at 2 a.m. And by analyzing the communications, Bob, sorry, Darth may be able to determine something's gone wrong or something's happening. So traffic analysis involves analyzing the communication patterns, and from that, gaining some extra information. Not analyzing the contents of the messages, but the fact that the parties are communicating. Another example is if Alice is a known terrorist, the law enforcement agency knows about Alice, that she's a terrorist, and the law enforcement agency is intercepting all the communications to Alice, and that law enforcement agency, Darth in this case, finds that this person, Bob, is sending many messages to Alice, and that may give the law enforcement agency some motivation to find out who Bob is, and maybe to follow up in some other way to try and find out what's going on. So by analyzing the communications pattern, the user here, the malicious user in this case, or the attacker can find out some information that would not be able to be learned otherwise. So that's considered an attack. Again, it's passive. If there was no attack, Bob sends a message to Alice, Alice receives a message. If there is an attack, Bob sends a message to Alice, Alice receives a message. Nothing changes from their perspective, so it's considered passive. Any questions on the first two types of attacks? First two example attacks? Both passive attacks? First one, finding the contents of the message. Second one, analyzing the communication traffic. Nothing difficult so far. Now let's look at four other types of attacks, and these are active attacks. Masquerade attack. Pretend to be someone else. Alice is the finance officer for SIT. She determines how much every faculty member gets paid. She puts the money into their bank accounts. Bob is the director of SIT. He sends a message to Alice every month saying, this person should be paid ex-bar. And that's the normal operation. Darth, some malicious faculty member, creates a message and sends an email to Alice saying, increase the salary of Steve by 10,000 bar. And signs that message so it looks like it came from Bob, the director. Alice thinks the message came from Bob, the director, and therefore increases my salary. So this is a case where someone else, Darth, is pretending to be a normal user, Bob in this case. As a result, things can go wrong. So masquerade means to pretend to be someone else in this case. Masquerade as someone else. Note that this is an active attack. If there was no attack, then Bob sends no message. Alice does not receive a message, if there was no attack. When there is an attack, Bob sends no message, but Alice receives a message. Something has changed. That's what we define as an active attack. The system resources have been changed because of the attack taking place.  How do you know who they are? They could be someone pretending to be someone else. So you need some way to authenticate who that person is, to be sure who they are. How can we solve this problem with the masquerade attack where the malicious user sends an email to Alice saying increase Steve's salary by 10,000 baht and pretending it's from the director, Bob? Is it possible? Is it possible for, for example, me to send an email to someone and that person think that it came from someone else? Yes, it's very easy. After the break we'll give a quick demonstration but it's very easy to change at least the from address in email. So when I receive an email, the from address says it's from someone who didn't actually send it. That's easy and without any other checks then that could mean that Alice would believe because the from message matches Bob would believe it came from Bob. So we need some other ways to authenticate and we'll cover them in this course. A replay attack. Bob, the real director, sends a message to Alice saying increase Steve's payment by 10,000 baht this month. He's got a pay rise, all fine, that's the normal operation. Darth intercepts that message and shortly later, one day later, sends it again to Alice. So from Alice's perspective, she's received two messages saying increase Darth's payment by 10,000 baht. So she increases it by 10,000 baht two times because it's a replay. She doesn't know that it's the same as the other one. She just thinks that Bob has sent, okay, sent it increased by 10,000 and then sent it again because Bob thinks that should increase it two times. In this case, the malicious user has replayed a previously sent message, resend a message in the network. Similar to here, but in fact, in this case with Masquerade, there wasn't an original message. Darth generated the new message. Whereas the replay, there's some message and Darth just copies that and sends it again. We'll see that when we look at the techniques for preventing Masquerade attacks and the security techniques, then sometimes it's easier to copy and replay a message than it is to generate a new message that will be believed. So replay attacks are possible. For example, no, no more examples there. Yep? Can you copy the message that I did in, I'm sorry, I said you're wrong. Again? The next one modification, okay? In this case, the replays one message is sent and the malicious user Darth sends the exact same message, a copy of that message, okay? Let's say that message is, let's say it is from some automatic telemachine from a bank and it's sending it because what happens in an ATM, you do some operations on the ATM and the ATM sends the data to the central office of the bank and it changes the amount in your account, okay? So when you put 10,000 baht into your account at the ATM, then that would send some information to the central office, some server there which would increment your account balance by 10,000 baht, okay? If we could intercept that message and send it again sometime later, that message from the ATM to the office, then the office just received two copies of that message and will increase the account balance twice, 10,000 and then another 10,000 which would be an attack on the system in that case. So this is just replaying the same message, no changing the message. The next one is changing the message, modification attack. Bob sends a message to Alice saying, decrease Darth's salary by 10,000 baht. He hasn't performed well. I want you to decrease his salary. Darth intercepts that message before it gets to Alice. Darth changes the word decrease to increase and sends it on to Alice. Alice receives a message from Bob, increase the salary by 10,000 baht, okay? So if we can modify the message, we can perform an attack on the system and this involves intercepting the message before it gets to Alice. So the question is, okay, Bob sends a message to Alice. Darth intercepts that message and modifies it. Then we say that's a modification attack, that the second message that Alice receives is different from the first one, it's been modified. Replay, Alice receives two messages, both of them are identical, they're the same. We can perform similar things, though, that is that we can perform the similar types of attacks. So pretend to be someone else, masquerade attack, replay messages, modify messages. They're the three main, and these are all active attacks, three main active attacks. Why are they active? Again, if the attack didn't take place, in this case, Bob sends a message, if there was no attack, Bob sends a message, Alice receives that exact message. If there is an attack, Bob sends a message, Alice receives a different message. Something has changed because of the attack. We say the system resources have changed, therefore we classify it as active. Last one, and slightly different from all the other ones we've seen. It's not so much about the messages now, it's about the availability of our system. We have a server. Normal users can access that server. Bob's a normal user, he usually accesses that server every day to perform some operation. In a denial of service attack, some malicious user performs some operations like send some messages to the server, such that that server can no longer be accessed by Bob. The attacker denies the normal users the use of the service, the use of the server. We deny access to the service, a denial of service attack. Coming back to, for example, Amazon. Amazon makes their money from people accessing the website, but a web server can only handle so many accesses at a time. It may overload and therefore it will crash, for example, a simplistic example. If some competitor of Amazon performs a denial of service attack, that is they generate a lot of traffic to the Amazon website such that the website crashes, then Amazon starts to lose money and the competitor, all the customers start going to the competitor. So that's an example of a denial of service attack, stopping the service being available to the normal users. So we've gone through six types of attacks. First two were considered passive and the last four active. Coming back, release message contents, traffic analysis. With passive attacks, nothing changes. Because nothing changes, it's hard to detect, because you cannot see that something's happening. From the normal user's perspective, everything's the same. Hard to detect. But generally easier to prevent than the others. So prevention is the main way to stop these attacks. Encryption to stop the release of message contents and to stop traffic analysis, you can introduce, for example, random messages such that it's hard for an attacker to analyze your patterns, hide the patterns of your communications. With active attacks, where the system is modified by the attack, hard to prevent them, but because the system is modified, something changes, it's easier to detect. For example, here, release the message contents, it's hard to know, it's almost impossible to know that DARTH has got a copy of the message. Okay, so it's hard to detect that's happening. With, for example, a modification attack, Bob sends a message, Alice receives a different message, something's changed, we've got ways that it's relatively easy to Alice to check whether that message has been changed or not. So there are ways to, we'll go through in this course of how to check at the receiver that the message has changed or not. And therefore we can detect that attack took place. Easy to detect, hard to prevent from happening in this case. You need to remember those six types of attacks and be able to classify them as active or passive. What about security services? So we have attacks on a system, we have mechanisms to try and stop, to prevent or detect those attacks, and we combine mechanisms together to provide some service, some service to the users. What is a service? Maybe the second one is some process, it's the second definition here, maybe a bit easier to follow. Some processing or communication service that is provided by a system to give a specific kind of protection to system resources, some service to protect the system. There are, people have different views of what the real, what security services are. In this course, and coming from the textbook, we'll define six types of security services listed here. Authentication. Authentication service is to make sure that we know who we're communicating with. That is to make sure if someone sends me a message, and it says it's from Bob, that it really is from Bob, it's not from Darth pretending to be Bob. Authenticate the sender of the message is the authentication service. Make sure it comes from the person who they say it is. If we can provide an authentication service, then we can stop the masquerade attack. We can, we'll be able to detect if a masquerade attack happens, if we can provide the authentication service. Sometimes we want to authenticate not just the peer entity, the other person communicating, but actually the data, that the data is in fact true. Another service, access control. Control who accesses our computer system. So our computer system or our network provides some resources to the users. Access control is the services about controlling who can access. For example, a good example is a firewall. A firewall controls who can access a computer. You run a firewall maybe on your laptop or your home computer. What does it do? It controls what other computers on the internet can access particular servers and software running on your computer. So it provides access control. That's needed in some cases. Data confidentiality. Protect the data, the message contents from being released. So from unauthorized disclosure. So I have a message. I don't want anyone else to read it except one person. Then a service that, or if that's provided, then we say that's the data confidentiality service or simply the confidentiality service. Keeping things confidential. Another word you'll hear or other words, keeping things private or secret. But it's better to use because we see privacy and secrecy in other terminology elsewhere in this course we use confidentiality. Keeping the data confidential. Data integrity. Making sure the data has not been changed. We saw with a modification attack. Bob sent a message. Darth modified it. It changed the message. The data integrity service, if we provide such a service, then Alice should be able to detect that the message has been modified. If we have data integrity, then we can detect changes. So if we send a message, we need a way to detect that the one that we receive is the same as what was sent. If we have such a mechanism, then we have data integrity. Number six, the last one. This one's a bit different. Availability. Make sure our computer system is available to the normal users. And the attack that this tries or this stops is the denial of service attack. Denial of service attack makes a system unavailable to the users. If we can stop that from happening, then we can say that we've provided the availability service. We make the system available to the users, the intended users. Last one, or number five, non-repudiation. And we haven't seen examples of this one. Prevent people from denying something's happened. Provide some form of, say, electronic receipt.  Do a similar thing in communications across a network. You send me your assignment via email, okay? And you need to submit by a deadline. If you don't submit by the deadline, then you get zero for that assignment. So you send me an email with the assignment. You would like, ideally, to get some receipt to say that I've received it. Some confirmation that I've received it by the deadline. Because if, and I don't see why, but if I deny that I received your assignment, what can you do? I said, no, I didn't receive it. You got a zero, okay? Then to prevent that from happening, we should have some form of receipt where you send the assignment and I send back some confirmation. Then if I deny that I receive your assignment, you've got some evidence. You've got this receipt saying, ah, you did receive it at this time and number and someone else, maybe the head of school, can come along and say, no, you did receive it. They can confirm that you did send the assignment. So confirming or protecting that against the denial of communications, prevent the receiver from denying that they've received a message or prevent the sender from denying that they've sent the message. That's the service of non-repudiation. Especially important for business communications, okay? Exchanging money, performing some business communications between two different companies, provide evidence that they've communicated in some way to ensure that no one denies that happens in the future. So they are the six services that we try to provide or that we may provide in some system. Depending upon our requirements of the system, we may not provide them all. With me sending an email to the secretary containing the exam, I probably should provide confidentiality encrypt my message so no one can see the contents of the exam. But the other services may not be so important. So it depends upon what the users require as to what services should be implemented, depending upon your system. So we have a tax, we have services and to implement these services to provide confidentiality, to provide non-repudiation, we have mechanisms. They are the techniques that we use to prevent, detect and recover from attacks. And we combine mechanisms to provide services. There's no single mechanism that provides all services. There are different mechanisms available. Most mechanisms that we use use cryptographic techniques. And that's why we spend a lot of time in this course explaining what is cryptography and what are these cryptographic techniques. Encryption is the main one. Some example security mechanisms. Encryption, listed here is encipherment, but we'll call it encryption, encrypting data. Digital signatures, and we'll explain them after the midterm, giving some signatures so no one can deny that they've communicated. Firewalls and access control. Authentication exchange, so to make sure that you're communicating with the person who you think you're communicating with, perform some exchange to confirm their identity. So there are ways to provide authentication. And some others. We're gonna spend the course going through those techniques. So we're not going to describe them now. The next five or six topics describe those techniques. This tries to give some mapping between different techniques and the services, although the terminology is slightly different from the previous slide. Just to give an example that there are different mechanisms. They are combined to provide different services. We will go through those mechanisms in this course. So, any questions on attacks and services? You need to remember those six attacks, which ones are passive and active, and you need to remember those six services. Guaranteed questions on each one. To finish, before we have a break, we'll introduce some simple model for network or internet security. The most common form of communications and how we secure those communications. They're variations, but we'll see this quite commonly. Just to introduce some terminology to get started. A common security mechanism that we use is encryption. We have a source computer. We saw in our examples, we had Bob sending to Alice. So, we have a source computer on this side, and we have the destination computer or user on this side. So, Bob and Alice. Bob wants to send a message to Alice, and between the two users is the communications channel or network represented here. It may be a single link, maybe a wireless link. It may be the entire internet. They could be on the other side of the world, or they could be five metres away from each other. But we have some communications channel where we send our message via. And we have our opponent or attacker or malicious user, Darth in the examples. We assume, this model assumes that the opponent can see and read anything that is sent across the information channel. So, whenever there's a message sent from source to destination, we assume the attacker can get a hold of that message and read the contents. That's the assumption we'll make in all our analysis. So, if we want to provide confidentiality, unless we do something, the attacker will always be able to read the message under this assumption. So, what we may do is we have an original message to send from source to destination. We modify that message in some way. We transform it. And we'll see that's what encryption does it. Transforms this original message into a secure message. Usually using some secret information that only the source and destination know. We don't send the original message across the channel. We send the secret message. We send it. The destination will receive this secret message. So will the opponent, the attacker. They can also receive this message. We can provide security if the recipient can from the secret message perform some transformation and get the original message back. If they can do that, then A has got the message to B. And importantly, the opponent should not be able to do that. The opponent, if they receive the secret message, should not be able to get the original message from that. If that happens, then we've provided some form of confidentiality or security. And that's the main form of security that we'll see at least in the first few lectures. Encryption is how we perform this transformation. How do we take some message, get a secure message such that the recipient can get the original message back, but the opponent cannot? That's the challenge. And we'll see that most cases it relies upon using some secret information, a key, where the recipient has the key or the secret information, but the opponent does not. Without the key, you cannot get the original message back. The recipient has the key, the opponent does not, so that should work in that case. We'll see that's the basic model for encryption and most, many of the security services use this model. Sometimes we'll see that there's another entity involved. What's called a trusted third party. So another user that the source and destination trust, they believe anything they say. We'll see that that trusted third party is sometimes used to support different security mechanisms. The trusted third party may have the secret information, but we trust them not to give it to anyone else. So that's a common model of a system that we'll use when we go through our different security mechanisms. A different one, which covers other cases if we want to consider network access, something like a firewall. Let's not try and describe that. I think it will confuse. We'll come back to that when we look at access control and talk about firewalls, I think in the last few topics, malicious software. Questions, this is our introduction to security. What we're going to do this afternoon also is introduce classical encryption techniques and give a few examples about those attacks. Any questions so far on the topic on introduction to security? Okay, question about traffic analysis, where are we? Let's assume that the message sent from Bob to Alice is encrypted. That means Darth can receive the message, but they cannot see the contents. They cannot read the contents of the real message. So they cannot release the message contents. What can they do with traffic analysis? Really, by observing the patterns of communications, they may be able to get information, not about the contents of the message, but about something that's happening. That's the idea here. The example, the terrorist example, that is if you're monitoring some known terrorist and so the law enforcement agency is monitoring and they know from past experience that if someone sends many messages in a short period of time to this person, maybe that's an indicator that some physical attack is about to happen in the future and therefore they may take some action, not on, they may take some separate action in that case. Another one is some companies. So a company has some trade secrets. A company, the way that it designs its software is kept private because that's where they make their money from. And they do some contracting work, that is they contract out to other companies. So this one company communicates with their contractor, some other software company to do work for them. Maybe a competitor can analyse that they're communicating in certain patterns to work out that they are doing work, who is doing work for the larger company. So here's a larger company, for example, and they want to, maybe a better example, Apple, okay, Apple makes iPads and so on, iPhones. They contract out to many other smaller companies to make the screen, to make the chips, the memory and so on, okay. So, and then competitors may want to know what Apple's plans for making the next iPad. They want to know how big it's going to be, who's going to make the chips. And from that information, they may be able to get some advantage and predict what Apple will do and maybe come up with a different product that beats it. So by this competitor analysing the communications between Apple and other companies, the subcontractors, they may be able to learn about what's the new iPad going to be made from. By monitoring that Apple is talking to a company that uses a 4K high definition display or a company that has some advanced hardware, then this competitor can work out that Apple may use that company in the new iPad. Maybe that's another example. Without knowing what the contents of the messages are, you can still sometimes work out some useful information just based upon the fact that people are communicating. There was a question, another one. Easy to prevent. Passive attacks, easier to prevent. Hard to detect because nothing changes. Easier to prevent generally compared to the others because using encryption we'll see. We simply encrypt the message in this case. It's quite easy to prevent this from happening in that we encrypt the message such that even though they can get the encrypted message, they cannot get the original message out of it if we have appropriate encryption techniques. So that's very easy to do nowadays. Similar traffic analysis, sometimes one way to prevent the traffic analysis is to add in some fake messages in the communications. So normally we send some messages between Bob and Alice. Darth analyzes that traffic to work out based upon the patterns. Well, if we add in some fake messages between Bob and Alice, then Darth may not be able to recognise what the pattern of communications is, okay? So that's a way to prevent such an attack. Active encryption doesn't help. It helps or we'll see it does help in some of these cases but not all of them. Replay attack, Bob sends an encrypted message to Alice. It's encrypted. There's nothing to stop Darth from intercepting and taking a copy of that encrypted message. Even though Darth cannot see the contents, they can still replay it so they can still perform that attack even when encryption is implied. So encryption does not solve all the problems there. We'll see that forms of encryption are used to help with the detection of these attacks. That's later. Any other questions? The model. Question about this model. Question is briefly explain it. No, I will explain it when we go through classical ciphers. We'll see some more detailed examples of this model in using some real ciphers to demonstrate that. So I will explain that later again, okay? Let's have a break.


YouTube, what's up, I'm back with another game play. This is salary cap ranked, the club series leaderboard. If you're not playing this and you want to compete, you need to be playing salary cap ranked season six games. If you win six, you get 90k coins and that's really a big deal for me because they're rewarding you to be a good player and get your wins. Even if you win five, four games or something like that, you'll get some good coins. Now, if you like these game plays, I really would like y'all to hit the like button, hit the sub button, and comment on what was your favorite player to game or what you think I could have did differently to make these games easier. I'm wearing the Raiders jerseys because they don't have any good Eagles real jerseys.   I think it's pretty cool. I think it's pretty neat looking, you know, look good, feel good, feel good, play good. Here we go. At first play, obviously these guys running a little 3-3-5-odd, the loop crossfire. So I'd like to get rid of the ball quickly. It's cover three, you know, so it's hard to defend the flats because there's not that many people over there and they are, they're either in cloud flats or hard flats. So you got to make the right read. Here we go and make the right read. We got a ball to hold up back. Easy first shot right down the field on that 3-3-5 loop. Didn't try to make a big play, didn't try to go up top, didn't try to match with tech, just made the right read, got rid of the ball and that's, that's how you have to play it. That's how you had to play it last year and that's how you have to play it this year. Make some quick reads. Here's this guy go. He's in tight. It's tight offset. I need to get good at recognizing which tight is which because each tight will defend you different ways. And here we go. I don't know how this happened to Patrick Peterson. It frustrates me because I'll press my cover three and he runs in withdrawal.  I'll back up Patrick Peterson and he'll decide to run up and press the wide receiver anyway and that's how you got burnt. So I gave up a cheap touchdown. I know you guys have watched his gameplay videos.  Here he did after getting, listen, after getting cute on, or after taking the basic on offense dot, dot, dot, he started getting cute on defense. I knew he would.  Here we go. Vic over throwing the high ball to moss. That's okay because you know, Tyree killed dropping the easy catch. Frustrating made me kick three there. You can't get mad at Vic for over throwing a high ball and you can't really get mad at Tyree killed for dropping the catching traffic. He's not the strongest wide receiver you're having for speed and not for catching traffic. I'm so afraid of that play happening again, but we're screaming at him. I don't want to give up a cheap touchdown. This guy's not good enough. I don't really know. The game's so early. I don't know if he's good enough or not, but he's damn sure good enough if you're giving up one play touchdowns to him. Here we go. We just start screaming at him with more. Get him to a third and 19, dumps the ball. Good play by him to get enough of the yards back. You know, 19, you don't have to go with 19 in one play. He'll no huddle.  But fourth and seven, I think my cloud flats can cover well enough to where I can run a maybe, maybe protect the sticks here, get like in between the cloud flat and hard for the audibles to this set, which I mean, I don't really like this set that much. I know there's only one crossing route in this set that can beat me. And that's pretty much what I have to guard. And he throws the ball at the Patrick Peterson. I got the glitchy patch, Russian Patrick Peterson doesn't allow that to go. Fletcher Cox got the quarterback made that an easy play. And here we go. Dot over the middle range and Moss really cooking with gas on offense right now.  So we're killing this three, three, five odd right now. So he has to press the issue. Now we're up 10 points. It's a great place to be on offense and mad and up two possessions. But here we go, the draw killing me. Fletcher Cox is rushing to pass it, but he's not really fighting for me on the draw. And again, I missed the tackle. Barnes-Baggins another 10 yards with Ronald Jones, a speedy rookie for the Tampa Bay Buccaneers. And here's a big play. I slept on this, but I didn't see it coming. It was the first time he ran it. Little wheel route. I went hard flat, so he was able to throw the wheel route over top of the hard flat and running the touchdown with Julio Jones. So that's kind of an easy touchdown. The next play by him that he used, and I won't allow that play to beat me again. It's something I really pride myself in, in recognizing a player's strength or a player's play that he likes to use.  Fool me twice, that's shame on me. And that's something I pride myself in. So that play won't beat me again the rest of the game. But it did for one. So I'm back in a three point game. Able to hit Tyree Kill over there on a little curl. Get enough yards for the first down. And we'll get it. That time I was greedy. I didn't take the flat. I got sacked. And that kills you. Second and 17, I dumped the ball underneath. Get a little bit of yards. Get me to a third and 15. This was good by him.  That's what happens when you get behind the sticks. You got to start pressing it. And you take one sack, and you're just getting in trouble. And we were melvin' in for my dive. Tackle, Michael Vickin. If you guys played man so far, the quarterback will fumble and shoot string tackles. It's terrible. It's probably happening to me more than anybody else in the world. And right there it just happened to Michael Vickin. I was able to get the ball back. So now we want to use as much time as possible. Hopefully get a touchdown. Todd Gurley fighting for me. Todd Gurley is my running back right now. I like Todd Gurley. He runs strong for me. There's Odell Beckham taking a hit over the middle of the field. We don't want him to go to Odell Beckham again. Can he fight in? No. But he uses all the time outs. That's okay. It's early in the game. There's no point in pressing it. I feel like I can play good defense and force him to work. And here we go again. He ran all verticals up the field. That should be a sack. Whereas the incompletion, which is huge, would save him at least 20 seconds. Here goes those little will route the Ronald Jones. Tackle him in bounds. That's all I want. Tick, tick, tick, tick, tick. Get him running again. This time a couple in the vertical route. And you know, he just chucks it at me. And Randy Moss catches it in front of me and boom. Gets him to the third VR line. Frustrating. I mean, he kind of had to chuck it. He's running out of time, no time outs. But for Moss to catch that right in front of my face, in my face, man. I don't know, man. Might be the Raiders jerseys, but I just got caught. Just got T-Bag by Randy Moss right there. But I kick off now that that three was big because now he's only down three. He has the ball. I feel like everything's gotten a little bit. Now to run is killing me. Great job of me clicking on and clicking off. Making that tackle with TJ Green. Not giving up a huge play. Here we go, Eric Barry in my spy going to get the quarterback. Boom. Once again, and we drop him. I mean, everybody drops a pick on that play. It might really be the Raiders jerseys at this point. But everybody drops a pick on the play. Then he throws right at me again, catches that. It's just getting ugly. Drop pick, catch my face, catch face, catch drop pick. I'm gonna get the ball back. You know, that's what's gonna happen. I'm gonna get the ball back when this continues to happen over and over. Here's that wheel route play again. I cover it, but he hits the backside slant and holds on to it. That's what I mean about recognizing the wheel route play and covering it. But he was able to hit the little slant over the top. TJ Green, catch him in the backfield. TJ Green is a great card. If you don't have TJ Green in your style like that line up, I mean, you're doing it wrong. Josh Jones, another great one. Tackle. Fletcher Cox fighting high ball over the middle, but gentlemen Ramsey knocks it out of Antonio Brown's hands. Hold him to three to tie the game up. It's 20 to 20. I feel okay. I still gotta put together a good offensive drive. I'm gonna get a stop. I know I'm gonna get a turnover. This guy is flirting with turnovers every other play. Here we go again, we're gonna run the little wheel route play. Hit him over here, Tyree Kill. I'm all conservative right now. So I can't make any moves because I'm feeling, when you start feeling the game wants to fight you a little bit, you gotta do what you can to make sure you don't fall into victim of that. Here we go, hit Odell on the bat. That's smooth. That's how I started the game. That's how I went down to field easily. Gotta get back to that. Hit underneath, hit Tyree Kill. Like I said, I'm all conservative. I can't spin or juke. So that's just killing me right now. Here we go, high ball to Moss. He was strafing 10 yards in front of him. When you high ball to Moss, you know, it's gonna take a lot. You're gonna have to pretty much sit on that and use her to stop it. So boom, we go right back down to field again. Get seven. We're up seven. It's time for our turnover. It really is time for our turnover because I feel like I should have five turnovers and I have none. Now finally we're starting to fight on a run. Clear as Clowney. Here we go again, Fletcher Cox fighting Melvin Ingram and Clowney both fighting. Get back into the play. Runs a little play action here. Throws it up to Pat P. You know what Pat P does? He knocks the ball away. I mean, I could have liked this super pick right there. Here we go again. We're fighting on the run a little bit. Clowney keeps Block Shudden outside. I mean, 10 carries, 19 yards a lot. Here he goes, a little play action. He puts three wide receivers out on the route. I don't know what he was trying to do. Throws the ball up, out of bounds. Gets with a third and two and you know, fourth and two sometimes are audible to man coverage. And all his wide receivers are super boxed. And we get our turnover. Not a turnover pick or a fumble, but turnover on downs. So here we go now. We're going to try to run the clock out in the game. He calls his timeouts early.  So when they do that, you got to go up top to Odell. Boom! Inside the five yard line. That'll effectively end the game, especially when Todd Gurley gets into the end zone. So now we're up 14, two scores. 10 or 14 at this point in the game, I think really doesn't matter that much. But we're up 14. So he needs to, the way he's playing offense, I feel like there's no shot for him to go down and get 14 points. Throws underneath, this is fine at this point in the game. I just want time off the clock. Time is my only opponent right now. Not this guy. No, every time he's going to this, he's ran four verticals and I got to cover Randy Moss on the crossing rope. And we get the sack, Ingram and Clowney fighting. Tackle them in bounds is all we can ask for right now. He no huddles. Third and 10, we got to make a play. Somebody got to step up and this game. I don't want to be in this game anymore. This guy shouldn't be on my field. What he is, he's taking a lot of time of the line. Runs a little zigzag route. That's okay. Go down here, tackle. Perfect. Just tick, tick, tick, tick, tick, tick, tick, tick, tick. That's all you want. You want the time off the clock. Gimbal fourth down. Second time in the game, he's gone to this formation. And one fourth down was, I don't know why he's in this formation. As one crossing route, I have to guard. That's pretty much it. And he's taken all day of the line of scrimmage. Got his two slants. I'm going to go back on the crossing route. And clowning against there in time. Gigi's in the chat. Pause the game, he quits. And that's the way it goes. That's the way the game went. I thought it shouldn't have been that close. But you know, that's the way every game you play, somebody's going to be in the game with you. That's pretty much how it is sometimes. And you got to fight. And you got to continue to keep your composure. No matter how many drop picks you have or catches they kept in traffic, you got to keep your foot on the gas and keep all your mind working on winning the game. If you like the video, if you want more game plays, like I said, hit the like, sub to the YouTube channel. You can also find all my offense and defense that you see in these videos on Mad and Turf. So go ahead, that link is in the description. Make sure you click that link. Check out Mad and Turf for all my offense, my defense. And you can also watch these games live. My Twitch channel link is in the description as well. Check out all the links in the description. Thanks y'all.


you're good? I can't move it I bet it's a good one looks like a even in the weed just in the weeds there oh yeah it's a big one giant, giant, staver look at the size of that one there he is boys my pb biggest pike ever 20 pounds 11 ounces probably close to 40 inches maybe more he's so thick look how thick that is he's all he's all full there he goes there he goes look at that awesome


Several ways a teacher can act in the classroom. The personality of a teacher, their attitude towards teaching and their relationship with the students have a major impact on the motivation of the class to learn a foreign language. Being kind, patient, entertaining and with a good subject, knowledge is some of the characteristics of a good teacher. Leading Part Their ability to interact with the class, to involve all the students equally through the lesson, to correct them without offending or affecting their motivation and to give individual attention when necessary, proves that a good teacher cares a lot not only about their teaching but also about the learning of the students. Depending on the type of activity and the results the teacher wants their students to achieve, they could take a dominant role or one that is more withdrawn. Role Model On the one hand, roles as a model, a controller, and an organizer require an active approach to teaching. For instance, is the main source of live English most of the students have ever encountered makes the teacher a model the whole class should look up to. His or her English grammar, vocabulary and pronunciation and way of expressing themselves should be impeccable. Likewise, when acting as a controller or a manager, all the attention is placed on the teacher due to the fact they are in charge of the class or the activity. They are the ones inspiring the students, usually standing in front of the class giving explanations and reading aloud. Besides, by giving instructions, organizing students into groups and pairs to do various tasks and bringing them to a close, the teacher often takes the role of an organizer where he initiates the activities. Individual Instructor On the other hand, roles as a tutor, a resource and an observer imply a more passive function of the teacher, only when his or her assistance is needed. For example, the role of a tutor is often employed when the students are working individually and guidance and support of the teacher are required or when they are in groups and need encouragement to finish a task. Furthermore, when students participate in activities that allowed them to get on with the process of learning a language for themselves, the teacher should not interrupt them or interfere. In case they need assistance or guidance the teacher should be available as their resource. Besides, in order to monitor effectively, the teacher should know how long an activity takes and how successful it has been by making notes for correction. As an observer, he or she should keep distance, but should still be aware of what is going on in the class. Evaluator Last but not least, taking on roles as an assessor, a prompter and a participant require interference by the teacher but he or she should not intimidate the learning process and should not dominate. Acting as an assessor the teacher should give feedback and correct the students' English, evaluate their progress and grade them. Being fair and consistent with all the students as well as sensitive to their reaction is vital for this role. A teacher who does not take the initiative from the students but gently encourages them to work out for themselves when stuck of ideas takes the role of a prompter. Sometimes the teacher also has to participate as an equal to their students without dominating in order to liven the activities up in case there is an uneven number of participants for group or pair work. Do you want to teach English to ESL students abroad? To sum up, during a typical lesson an experienced teacher should be able to switch between all the roles mentioned above appropriately and should be aware of how to carry out the required one. It is of great importance to know which role to take and when as well as how to engage all the students equally in the learning process. Speak with an ITTT advisor today to put together your personal plan for teaching English abroad. Send us an email or call us toll free at 1-800-490-0531 to speak with an ITTT advisor today.


And now, tonight's presentation of Radio's outstanding Theatre of Thrills, Suspense. Tonight, the story of two young men and a frightening dare. We call it The Game, so now, starring Sam Edwards and Gil Stratton, Jr., here is tonight's suspense play, The Game. There were two of them. They stood on the corner of Maine and Elm, leading back against the wall, indolent. The summer sun warm, bringing to them the astringent odor of soft tar and the cracks of a sidewalk. It was two o'clock by the hands of the jeweler's clock a few doors down the street. And it was at two o'clock, quite innocently at first, that the dreadful game began. What do you want to do, Penn? I don't know. You? I don't know. I guess we could have a couple of games of ping-pong. You got the dough? Forty cents. We could, Red. I don't know. No, I don't feel like it. Okay. Hey, we could shoot some pool. What's the matter? You always want to play games, kid stuff. Know something? What? I feel like getting drunk. You're kidding. I'm not kidding. You're kidding. What do you want to get drunk for? For fun. Some fun. My folks won't be back till later tonight. Not me, boy. Not me. I can get hold of a bottle. Not me, boy. Chicken? That's me. Okay, so long. Hey, Red. Wait a minute. You kidding? What do you want to do that for? You got any better ideas what to do? No, but... Okay, I'll see ya. You know what would happen if they ever found out? They won't find out. You can stay over at my house tonight. Call you folks and nobody'll know. Don't you ever want to do something different? We're not kids. Maybe you are. Maybe you need a couple of drinks to grow up. Big man, I'm two weeks older than you. Not up here, boy. Not up here. Nuts to you. And they walked slowly, carrying the idea to a white house with gray trim. A house well-lived in, empty now but waiting. And the boys went in, upstairs, and to a room labored with ships, and penance, signs, and maps. The one, Red, disappeared for a few minutes. The other tried to become interested in a book of fighting ships. He was afraid of what was to come, knowing why and not quite knowing. That your father's? No, the gardener hid it in the woodshed. I found it a couple of weeks ago. He hid it somewhere else. Boy, I'll bet that fractured. How do you like it? Well, I don't care. Straight? Sure. Water chaser? What about you? No water for me. Same thing, then. Sit down. We'll talk. They drank, and they didn't like it. But they'd started the game and they couldn't stop. A small clock with an owl front piece ticked above them. The eyes of the bird metronomically switching from side to side. A car passed occasionally, and there was a tension until the sound of tire and engine faded away. It didn't take too long for the warmth to grow, and the eyes to become hot, the tongue loose. Boy, not bad, huh? Feel pretty good? Pretty good.  Yeah, wouldn't be bad. You ever take her out? A couple of times, I guess. All right, huh? Nick? No, I thought you two were like that. That's what I heard last term. You kiddin'? You know...  What? You're soft. I'm your friend, boy. I can tell you. What do the other guys think? You know, dutch, boy. Not all air, not enough. I'm your friend, Penny.  But you gotta have guts. I've got guts? Not enough. And that's what all the guys think. Pin's okay, but kinda soft, you know? Chicken. Yeah? I'm tellin' ya. I don't wanna be a pal or a guy who's soft. You gotta be hard, be like the other guys. How do you figure all this? Nobody asked you. I know what I am. I know. I'm not soft, not chicken. Ah, you. You're afraid to get drunk with me. I'm gettin' drunk with you. Because you were afraid I'd think you were chicken. That's why. That's why. You're crazy. I've seen you afraid, Penny. I had to explain it to the guys. When? When?  You were a chicken then. You're crazy. The guys thought you were afraid of the gun. That's not chicken. That's what I told them. But I'm not sure. Let's forget it. Uh-uh. You can't run out on that, boy. I'm your friend, Pin. I'm tellin' you for your own good. Okay, okay, you've told me. I'm chicken, no guts. Forget it. Afraid of a gun. You and me could never go huntin' up in the mountains. I'll tell you that. Cut it out.   You wanna fight? Is that what you want? You wanna? Because if you do hunt, that doesn't mean anything. Kid stuff. I got a better idea. You wanna really do something? That'll show, boy. That'll really show it. Do what? Play a game. You like games? Real easy game to learn. Nothing to it. Here. Have a drink. Sit down. Game? I read about it a while back. Russian roulette. Never heard of it. Some kind of gambling? I'll tell ya. It's real easy. First, you get a gun. A revolver, Penny. Bullet gun. So what? You take one bullet, and you leave it in the gun, see? Then we take turns. What kind of a crazy game is that? We take turns pointing at our heads and pulling the trigger. If nothing happens to you, I take the gun, spin the cylinder, and point it at my head, and shoot. You call that a game? Sure. See which one goes chicken first. You never know where the bullet is, and if you spin the cylinder and the bullet comes up on your turn, bluey. That's nuts. Well, in this book, it went on a long time, and then one guy got like you'd get. He was chicken, and he folded up.  I'm sick of it. You hear? You want to know something? You'd get chicken before me. You! Oh, I wouldn't do it to you, Penn. Don't worry. It wouldn't be fair. Forget it. Wait a minute now. You started this, so go ahead and finish it. Your old man got a gun? Has he? Sure. Okay. You want to be crazy? Go ahead. Get the gun. Go ahead. Well, go on. Get it. Let's start playing. Red smile a smile of pity. With deliberities, he sauntered from the room. Penn might have seen him stagger a moment as he reached the door, but Penn wasn't looking. He was noticing, for the first time, his hands lying flattened on the table, disassociated. And there was a scar on the right index finger. He'd got it when he cut himself 12 years before on his first borrowed scout knife. Now, the scar. A memory on a trigger finger. He didn't look up again until Red came back with the gun. 38. That's the best gun. Want to hold it? No. I figured you wouldn't. It's okay. We'll forget it. Uh-uh. Go ahead. Take out the bullets. Okay. Take out five and leave one, huh, Penny? Yeah. Take out five and leave one. One bullet. For you or for me. Okay? Okay. The gun. The gun rested muzzle to the wall in the center of the table, bearing the scratches made by a three-year-old in a forgotten moment of high experience. The boys sat opposite each other, looking down at the gun. And the gun waited. You want to go first? Doesn't make any difference. Me neither. Flip a coin. Okay. Call. Heads. Okay. I'll take the first shot. There was a ceremony to the game then. Sportsmanship with a toss of a coin, a drink of whiskey. The glass put down. And next to come the lifting of the gun. Pins stared at it and thought how he could best reach out to take the handle gracefully, practically. He had never held a revolver in his life. He had to spin the cylinder? Yeah. No, no, the other way. What's the odds the bullet comes up when I shoot? I don't know. One in six, I guess, I don't know. He was a careful boy. And so he didn't put the muzzle to his head immediately. At this point of the game there was a numbness which did not allow for speculation of pain, mother, father. Rather he was surprised by the weight of the gun, the little oneness with it lying in his hand. He was afraid of it and fascinated in his fear.  Seeing the friend of his youth slowly raise the gun, unsteady and awkwardly turning the barrel to his head. He wet his lips and waited. Didn't go off. No, how'd it feel, Penn? I don't know. Were you scared? I guess so. I don't know. You sure looked scared, real white. I didn't think you'd do it, you took long enough. You're doing a lot of talking. You scared? It's your turn. Give me the gun. Boy, that's a real gun. Remember when we were kids? Cap pistols. Bet you never thought we'd be doing this. No. Okay. My turn. Where are you, baby? Where are you? You want to make a side bet on this one?  Watch, Penn. When you make up, you mind to do it. Do it quick, see? Like this. You sweat it out. Pretty good game, huh? I'll make you one bet, though. What's that? You crack before I do. You're nuts. A buck? A buck? Sure. A buck. The game had taken another turn. It presented an added incentive to win. A dollar bet that one boy would be a coward. A boy would lose his nerve. Wouldn't have the guts to take another chance at blowing his brains out. Good bet that. The room was too warm. And outside, the middle afternoon sun blazed down hot on the heavy sycamore trees. Dusty and still. A 12-year-old passed by on the street, whistling tunelessly on his way to the drugstore for a soda. Go ahead. Or do you want to quit now? I'll do it. Don't worry. I'm not quitting. Boy, I'll say this for you.  It gets tougher now, though. It's all in luck, you know. You're lucky, Penn? Yeah. I'm lucky. That's good. Maybe you need another drink, huh? No. I don't want any more. Okay. Well? Red? What's the idea, huh? What are you pointing it at me for? You scared? No, I'm not scared. Maybe we should play it this way for a while.  That's not the game. Why not, same thing? No. That'd be like murder. You want to play, you play it right. Who says the way we've been playing is right? Oh, I get it. You're trying to get out of taking your next shot. I'm asking you. Who says the way we're playing is right? Listen, will you quit pointing it at me? What difference does it make? Just tell me that. It's the difference we're playing Russian roulette. That's the difference. If you want to quit, say so. I'm not quitting. Okay, then. Take your shot. It was a thing to be well-considered on the part of Red. The present abstract quality of self-destruction was one thing. But a gun pointed at him. Gun held in another hand. This was not a game of his choosing, and he would have no part of it. Suddenly, he knew himself to be sober, terribly sober. And because of this and the fact that the game had mushroomed beyond his understanding, there was no stopping the play. He knew that pin was sober too. And as from a great distance, he saw his friend raise the gun, but steadily this time, pressure whitening the index finger, the muzzle touching just at a pulsing vein he had noticed in Pin's temple.  I'm lucky too. You better be. My turn now. My turn. Why didn't he quit? He's never had guts. Why didn't he quit? Maybe he's so drunk he hasn't got the sense. No, he's not drunk. Why didn't he quit? It's my turn. I gotta do it. He'd tell everyone if I didn't. He'd tell them all and they'd laugh. I don't know. It feels... It feels like the bullet might be coming up. Not yet then. Not yet. I gotta smile like I was enjoying it. This'll be something to tell our kids, huh, Pin? Yeah, sure will. How long are you gonna take? What's the matter? Make you nervous? Why should I be nervous? It's your shot.  Red's scared. He doesn't want to do it. I'm not the only one. All this big talk. He's no more than me. All that big talk. Look at him. He's scared. It was at that moment that Pin discovered this truth that he knew he wanted to. He couldn't quit the game. And as he looked at Red, he became aware of a great anger that had no direction, no apparent reason, but it filled him and made him strong. Let's quit, Red. You're crazy. I want to quit. Nuts to you, it's my shot. I don't care what quit. You quit when it's your shot. I'll take care of myself. I'm telling you, Red. Put the gun down. Drop dead. Put it down.  Yeah! Get your hands to the phone. No, I'm with Pin. No, I'm fine. Out of breath. We've been playing. Kind of rough, I guess. Oh, sure, Mom. Everything's fine. Okay. Okay, Mom. Sure, Mom. Red stood by the telephone for a long time, and he cried as he hadn't cried for a long time. Pin stayed in the room. He felt it, too, in his throat, the thickness, the tight-held tears. Neither boy knew what it was or why. And then after a while, it was calm again. Red came back in. That was Mom. Paul? She said we could go to the tavern for dinner, if you like, and charge it. That'd be okay, Red. It's well. Yeah. Guess we'd better clean up, huh? Guess we'd better. Cleaned up, not saying much to each other. They felt very close, and were not able to express their closeness. Then there was a last thing to do, and the last part of the game to be played. They had to know. So they walked to the edge of the town into a shallow ravine. Red took the gun from his pocket. He still had this shot he'd never fired at himself. He aimed at a half-burned tree stump, 30 yards away, and slowly began to squeeze the trigger. Suspense. In which Sam Edwards and Gil Stratton Jr. starred in tonight's presentation of The Game. Next Tuesday, the story of a rehearsal and the performance of murder. We call it The Cellar. That's next week on Suspense. Suspense is produced and directed by Anthony Ellis, who wrote tonight's play. The music was composed by Leith Stevens and Lucian Morrowick and conducted by Wilbur Hatch. Featured on the cast was Mr. John Daener. This is the CBS Radio Network.


I am super happy to be here. This is super impressive. And I came to talk to you about a bunch of things. There's two very important things you need to know about me. The first one is that I'm very lazy, and I'll always look for the quickest, fastest way to get stuff done, which I would say is a strategic advantage. Some other people might disagree. The second one is that I just got a new job. Thank you. And it comes with a buttload of imposter syndrome. So I sign the contract. I start my job.  I have no idea what I'm doing. I don't know if you can relate. But yeah, starting a job as senior SEO manager at Sanity, which is a fucking, wait, sorry. I'm very good. Sorry, sorry. A very good endless CMS. Instructed content platform stories were a lot. And I was like, I have no idea what to do, right? So I did what all of us here do. I turned to the internet. And there were so many helpful SEO resources, many created by people here, sitting in the front row, sitting over there. I know you. I've seen your faces on Twitter. Yeah, that's a lot. It was a lot of very overwhelming stuff. That's just generic best practice, right? Like, is this an SEO strategy? I was hired to be an SEO strategist. It's absolutely not. And then at some point in the entire mental breakdown that I was having, I remember that I'm actually an expert in SEO gap analysis, right? So let's ground it down and talk about it. Why a gap analysis? This is incredibly, incredibly unsexy topic, right? It sounds really boring. But personally, I really, really like it. And that is because it brings us back to first principles. It is we're not ranking in a vacuum, right? We are just trying to do better than our competitors. Ranking is as easy or as hard as doing better than your competitors. There's no more to it. There's only a few spaces on the first page on results in Google. And you need to be better than the billions of people that are trying to rank for the same stuff as you. I'm going to structure these gap analysis around the three pillars of SEO, right? So we're going to be talking about technical. We're going to be talking about links, slash, brand, slash, whatever. We're going to be talking about content. And the way that these three relate to each other. So technical SEO is there to help you delight your users and help search engines find you, crawl you, and understand you. Links are there to say, yeah, I vouch for this content. This person knows what they're talking about. But it is the content, ultimately, what's going to satisfy your user's queries. We're not just googling for the sake of googling. We want to get something done. So look at those three pillars and consider that if you're already the best of one of the three, you're not going to move the needle by furthering that advantage, right? If you're the fastest website, if you've got the most content, if you've got the most links, by getting more links, you're not going to get better. By getting more content, you're not going to get better. You need to find what's the one that your competitors are doing better than you, right? And in order to do that, we need to answer three questions. First one, who are your competitors? Like, really, who are your competitors? We've all landed into a new company, and they've been like, oh, yeah, we're competing against Amazon or against Microsoft. And it's like, no, you're not, right? Let's get that out of the way. Then we're going to have to talk about, what are they doing?  So it begins with competitor identification. Question number one, who are your search competitors? There's three, in my opinion, there's three ways to identify a search competitor. The very first one is they are satisfying the same need for you, right? So if by hiring your competitor, the consumer need gets satisfied, you're no longer needed. Therefore, that's one condition to be a competitor. They're ranking for the same keywords that you are trying to target, and they're speaking to a similar segment of the audience. So you have a similar audience persona. That's how you know you're competing with these people on the SERPs. It's not just a like for like competitor kind of thing. There's two approaches to competitor identification coming from these principles. We've got a top-down approach, very, very easy. And we've got a bottom-up approach that builds a lot of relationships within the business. The top-down approach, we know this one. We go to sales, and we're like, OK, who are your competitors? Who are you competing with? We go to customer service, and we ask them what comes up when you are talking to our customers. Do they ever bring up, this one does it better, this satisfies my needs better? And then you check your list against your favorite competitor research tool. We've got millions. So just cross-check it. And then you've got it. Combine the tool list, and you've got the sweet spot between product competitors and actual search competitors. This is really easy. It's a really fast approach, and it's really good to satisfy your C level, because you're using their input and combining it into a bit of a middle ground. What I like better is the bottom-up framework. So in the bottom-up framework, you identify your target keywords. If you want to be really specific and really targeted with your efforts, you should also cluster them by topic. You download the top 10 results from the SERPs and measure how much of the SERPs this competitor is dominating, right? And you can drill down by topic. As I was saying, this is really key, and it ties up very nicely with Andy's talk at the very beginning of the conference, which was a very intimidating talk, because now I have to come on stage and meet that. But since this is a little bit tricky and hard to explain on a conference, you've got a template here with a step-by-step guide that you can follow. So we know who our competitors are. It's time to start benchmarking. It's time to understand what they're doing and how we are performing against them. It's time to reverse engineer your competitor's SEO strategy. And as I was telling you, I am lazy, and I'm going to look for the fastest way to get around this. I'm going to let them and their work and their data do the work for me. Perfectly fair. We're going to start looking at content metrics, right? So something that you can be looking at is keyword rankings in the top 30 position, the estimated traffic for editorial URL, which is something quite interesting, because it measures the quality of the content. You can do a keyword gap analysis to understand where they are that you're not. An estimated traffic by type is something that I really enjoy as well, because it really tells me where they're focusing their content efforts, right? For SaaS, it is very relevant to look at branded versus unbranded traffic, their editorial traffic, and product traffic, which is where the conversions are going to happen. So I did this, right, for my company. I started looking at what Sanity is doing and what our competitors are doing. I realized that we have some of the highest editorial traffic, but not the biggest editorial traffic in general. That means that we're probably lacking in product traffic. We're probably lacking in branded traffic. We'll look at this later. We've got the least content or some of the least content, but the content that we have performs really well. That is the column titled editorial efficiency, which is something that I made up for this. And yeah, for every URL that we have on our editorial section, we've got significantly more traffic than our competitors. Then it seems a little bit obvious that what we need to be doing is putting out more content. Then we're going to be looking at brand metrics. We're going to be looking at referring domains, at backlinks, domain authority. Bear with me.  Where do they have links that we don't have? We're going to look at link growth. Have these people been link building in the last six months? Is my market a market that focuses a lot on building links and building brand? I'm going to be looking at brand surge volume, because it informs how we are sitting within the brand perception for the market. I'm going to be looking at branded traffic, which does something very similar, and something that's not quite quantitative, but more qualitative is brand positioning. So this is what this looks like for sanity. Here we can tell that we are very clearly below average in terms of branded traffic, in terms of backlinks, referring domains, kind of in the middle when it comes to DA. And brand surge were actually quite high, which is something that surprised me. And when it comes to link growth, we are the biggest. But this is one of the most actively link building markets that I've worked on. These are numbers that I don't typically encounter when I'm doing a link growth analysis. This is measuring how many the growth in the last six months. We have grown by 65% of referring domains, which is crazy. But one of our competitors has grown by 58%, which is also very, very intense. So yeah, I can see very clearly that we're going to be needing some brand work. We're going to be needing some link building. We've got brand volumes, so maybe our PR team is not really using linkable assets. It's a conversation that I'm going to have to have, and then I'm going to have to type in. And then I look at it at the brand positioning here. This is not quantitative. This is qualitative. And I really like looking at it to understand how my competitors are going to be talking about themselves within the market. I look at what our H1 on the home page does, and I look at what our meta description says, along with everybody else. So most of our competitors, we can see are talking about headless CMS, headless CMS, managing content. We're talking APIs. We're talking fast, fast. That is sort of the value proposition that's being used in the market. And on our home page, we've got content is data. What does it mean? I have no idea. I don't think anybody knows. We need to have a conversation with the brand team, because that's weird. Anyway, moving on to Tech SEO. It's one of those stack lines that's like, who wrote this? Anyway, Tech SEO metrics. I hate saying it depends.  But it does depend, right? The needs that you have as a website or with your trading your website as a product than you should are going to vary depending on the niche that you're in. I'm in SaaS. I love SaaS. SaaS is pretty easy to manage from a tech SEO perspective. I have to focus mostly on web performance optimization. I have to check that everything is scrollable. I have to check that everything that I want to index is indexable and that all my major files are working as they should. But as we saw on a reach talk, if you're in an e-commerce, you're going to be in a very different situation. So trying to find the most universal solution for most niche, I'm going to be looking at core web vital scores, page fit insights, and performing some manual checks. So this is where we are. Sanity, we're kind of like middle to top tier when it comes to core web vitals, page speed, and on mobile and on desktop. Essentially, what I've done for the core web vital score is I've grabbed all the good, like the percentage of good URLs for each of the main core web vitals. And I've averaged them as the score, generic score. We're doing kind of like mid to top tier in the market. It wouldn't be like the biggest area of focus for me. So yeah, we are found out what we're below average at, and we're going to work on it. That's where the results are. So what are the results of this benchmark? We're kind of averaged for content, basically, because we're not publishing enough. We're below average when it comes to links, even though our brand has one of the best brand recognitions. And we're kind of averaged in Tech SEO, which is OK. I'm good with that. So what are we going to do next? We've got a gorgeous spreadsheet. As you saw, everything was like conditional formatting. We've got the brand colors in there. The C3 loved it. But it's just a spreadsheet. I've not gained any traffic. Because without execution, there's no ROI. And execution is scary. This is also something that Arish mentioned earlier in her talk. When you push the Life button, you're kind of proving or disproving whether or not you're a good SEO. And that is terrifying to me. But we need to execute. Otherwise, there is no point to our jobs. And I'd like to keep mine. So you're going to have to make a growth plan. The very first step, identifying our weakest pillar, we've done that. Brand is my weakest pillar. And I'm going to have to understand why I'm not performing. I've got brand recognition. I've got branded searches. I'm growing in links. But I don't have enough branded traffic. And I don't have as many backlinks as some of my competitors do. So for branded traffic, we're going to do a little project of branded. We're going to try to tackle all the queries of people looking for our brand plus something else. For example, there is quite a lot of searches around sanity SEO. People trying to figure out whether or not we're good for SEO. And all those searches are going to the home page or to people talking about it on Reddit because we don't have that content. So we're going to create that content. We're going to make compare pages. There is an entire editorial plan planned out. And we're going to be looking at doing some digital PR and some link building both to keep up with our link growth and also the link growth of the market, which again, it is crazy. And try to support our existing PR efforts with some linkable assets so that all of that brand search gets translated into domains and referring domains as well. Then I'm going to roadmap how this is going to improve. I've talked you through some of the steps that I have considered, a branded search content project, some collaborations with PR. And I'm going to try and get stakeholder buy-in. A little secret here. Start with a pillar that requires the least buy-in. When I'm talking about doing link building, about doing digital PR, especially if I use the word digital PR, this needs to go to the CEO. This has definitely got to be a talk with the CMO. This needs to get CEO approval. It is likely that I'm going to have some layers of approval beforehand. And I just arrived at this job. Nobody knows if I'm good at it or not. So this is going to be very difficult for me. So I'm just going to go with content, which is also average or slightly below average. And it's a very quick win for me. And then I'm going to be able to get buy-in for the brand staff. So we're talking content. We're going to be combining the branded content project that I was telling you about with some editorial projects as well. And just try to leverage that editorial efficiency that we've got against competitors, even though we are one of the websites in our market with the least amount of editorial URLs. So we're going to go for it. And then it's a trick part you've got to execute. I know this was a lot, so make it yours. You've used your best judgment. The metrics that I've used might not be the ones that work for you. If you're not in SAS, you definitely need to be looking at a lot more tech CEO stuff that I am. So use this template, make yours, change it up to you. It's there. Now, do I know what I'm talking about? I've been an SEO for about eight years. I've been working in media, in SAS, in e-commerce. I've been an agency side. Ola introduced me as having a degree in marketing and a master's degree in digital psychology and one in digital business, which, by the way, was a waste of money. Generally, don't do that. And SEO strategy is kind of my job, right? I'm here to be strategic and show you what to do. Speaking of strategy, I've got a little thing for you. I've got a free upgraded plan on Sanity.  So I'd really appreciate if you signed up. Thank you very much.