Stanford University. I'd like to welcome our panelists to come join me on the stage, and I'll introduce them as they come on up. We have Sally Benson, Precourt Family Professor of Energy Science and Engineering, and Senior Fellow at the Precourt Institute for Energy, at the Woods Institute for the Environment, Steven Powell, President and Chief Executive Officer of Southern California Edison, Nancy Fund, Founder and Managing Partner with DBL Partners, and Jason Glickman, Executive Vice President of Engineering, Planning and Strategy at PG&E. Welcome to you all. So let's maybe start if we could with the challenge I was outlining there is we're electrifying everything. How do we do that and support grid reliability? We did have a challenge in 2020. We had an outage over two nights, August 14th and 15th, that affected 500,000 customers, and that's the only outage on the trunk grid we've had in 23 years, but it created a huge firestorm of response and became a national news story, and so we have to do both things, support grid reliability and decarbonize and electrify. How do we strike that balance? Let's just go down the line. Great. Well, first of all, David, thank you for having us and Arun and the team. I will say it is I'm a double Stanford alum, Management Science and Engineering, and so it's a little bit of a homecoming. It's fun to be back on campus with everyone. You know, I think that event, everything you said, David and Arun said about California needing to set a positive example, and having the world root for us and having the media and stakeholders root for us is so vital. So we can't have those stories and examples where livelihood and health are threatened because of issues on the grid. I think we'll talk obviously a lot today about the amount of infrastructure build that's needed, you know, continuing that pace of storage, build out, transmission build out, offshore wind, everything you talked about. I think the ingredient or an ingredient we are really, really focused on, we need to be focused on as a state, so we appreciate the seven gigawatt goal and particularly our PG&E is on that load flexibility side. Getting a lot more intelligent and surgical about where and when the demand is and is coming and the ability to manage that load in a different way.  And I don't know how many folks here remember getting a text message that day. Does everyone remember? Some remember got a text message saying, you know, I can't remember the exact text, but it was please do your part. And we were sitting in our operation center for PG&E watching, you know, watching probably the same charts that a lot of folks were for the Kaiso and you saw this, you know, near instant two gigawatt decline in load from a very frankly blunt force instrument, right, a text message that I don't think we want to be deploying that with regularity. But I do, it does have us wondering about what is the power and the potential when you can have the choreography of all these electrified devices on the grid, whether it be a pool pump, an EV, your AC load, etc. I think that's, we think that's really going to be a vital ingredient that we need to be able to bank on and make sure the grid's reliable and scale long-term. Thank you, Nancy. I'm Nancy Fund with DBL. I've been working with many people on this stage and with many of you in the audience for 20 years. We're just facing our 20-year anniversary this year. And what we do is try to answer the questions that David and others asked with innovation, with entrepreneurial investment.  And we're so proud to, I don't think DBL could exist in any other state but California, but now we need, of course, to spread what we're doing globally in order to safeguard the health and safety of our next-gen citizens. So in terms of the electrification, the ability to have grid stability, I mean, we all know the answers. We need virtual power plants. We need demand response. We need smart grid tools. We need more renewables storage. And as David pointed out, we're doing a very good job at that. I would say that, again, looking at the entrepreneurial lens and trying to see how do we create the big companies of the future that will create the jobs that people want to have and contribute to a tax base so that we can fund these programs, it's important to recognize that distributed resources play a critical role. And that's an area where we're actually seeing some stepping away. Rooftop solar is going down as much as by 50% or 40% because of changes in law. We don't have to get into all of those details, but that is a thriving area that we've exported to other places and plays a critical role in resilience. I think we all read and actually have experienced when the power goes down or when there's a hurricane or a fire, some of those communities that have residential solar, that have residential storage are the beacons of functionality. And so I think there's a lot to be learned there. And not that we want to depend on distributed resources for everything. Of course, that doesn't make sense, but they play a critical role. And in terms of hearts and minds of Californians, very, very aspirational, very important to kind of who we are. So I would say don't, as we move to post-net metering and such, we really do need to recognize not just the generation capacity that we get from distributed, but the resilience. And then I would also say that we spend a lot of money and my fellow panelists can say this more specifically, spend a lot of money fighting wildfires. And we could spend that differently and more productively if we could avoid the ravages and the loss of life and the carbon generated in wildfires. And I'm sure we'll get to some of that. But certainly tools to prevent wildfires, get to them sooner. This is all doable. These startups are beginning. We're working with utilities. And it's time. It's been completely like the cigarette smoking of the 60s, those ads that David showed us. You know, the smoky the bear motif is just not okay for the 21st century. And we can use tech. We can even borrow from companies like Lockheed Martin and folks that know how to do precision dropping on targets and reduce the complete disaster of catastrophic wildfires and allow prescribed good fire to happen more safely. So we're excited. There are so many areas to invest in. We'd like to read really early on that curve as we were in EVs back in 2006. But we do need the trifecta we call it of policy innovation and capital to come together. And so I would draw our attention to the huge amounts of money that we're spending fixing things that could be prevented and create new industries at the same time. So I look forward to talking about that. All right. So I think the conversation around the use of distributed resources, whether that's how you manage electric vehicles, everything on the customer side is a key ingredient. Absolutely. You know, David, you talked about the amount of energy storage we're already putting on the grid. So to get enough energy capacity on the system is really important. I look back at what happened in 2020 and most people that were involved in those rotating outages lost their power for 30 minutes or an hour. Outages like that are, you know, and they could, you knew in advance hours even that you may lose your power. Outages that happen, you know, on the grid, customers may be out for a 24 hours because of a grid outage and they're out that long and they didn't know what's coming. So there's not as much planning. So when you talk about grid reliability, the amount of resources and energy in the system is an important part. The functioning of the grid underneath it is critical, the wires. And so it's another piece that we focus on a lot. When we look at, you know, what needs to happen in the state by 2045, certainly all this electrification is going to lead to a lot of load growth. For Southern California Edison, we think that's 80 to 90% load growth by 2045. That's a lot of additional load that has to flow through our wires and our infrastructure. When we look at what we have to do with the grid itself, between now and 2045, we're going to need to build about four times the number of transmission line miles that are built in a year to each year today. We have to do about 10 times the amount of new distribution circuits on our grid every single year than the ones we're doing today.  The grid investment has to be huge to go with it. So when you look at what has to happen on the grid, there's a number of pieces and I break it down into reliability, resiliency and readiness. On the reliability side, a lot of the grid is old, been built over years and years. And so we've got a lot of investment just replacing aging infrastructure. We don't replace it with what was there before. We've got to replace with updated standards and change how we're putting it out there. Grid modernization, getting the sensing, the automation, the technology to control things more autonomously is another important part. So that's unreliability, resiliency. You mentioned wildfire, which is a lot of our investment has gone into hardening the grid against wildfires. But it's not just going to be wildfires. It is other extreme events, climate adaptation overall. It's going to create a lot of investment needed to fortify the grid. And then on the readiness side, that's really the load growth that we're seeing. So we've had basically flat load growth, no load growth, for nearly two decades. Now with electrification beginning to swamp what you're seeing from rooftop solar and what you'll see over the next number of years, we still believe at least half of roofs will need solar on them by the time you get to 2045. So that part will happen too. But making sure you can connect customer loads so you can, all the new EV chargers, the data centers, all the load growth that's happening across our systems, getting ahead of that, not waiting for the load just to show up. We're going to have to invest in advance. Otherwise you're not going to be able to keep up with the tremendous load growth when we start growing at 3% and 4% a year. So for me, how do we get there? It's looking at every facet of the grid. Yes, you've got the resources that connect to it. You've got the customers and how you control their loads. But the wires in the middle need an overhaul and need a lot of investment. And that's really a lot of what we're focused on as well because those outages can be really impactful and unpredictable for customers. Great. Sally? Okay, all of the above. Anyway, it's great to be back here in California. I think a lot of you know I spent the last two years or good part of the last two years in Washington, D.C., working in the White House Office of Science and Technology Policy on all of the innovation issues that we're talking about. And I can say that we are in an incredible situation in part because of California's long time leadership that there are many incentives, financial incentives that are going to help us go farther and faster even than we could but for California's amazing policy. So more renewable generation, hydrogen, EVs, heat pumps, you name it, there are now incentives available through the Inflation Reduction Act. And for the infrastructure, a lot of the things you've talked about, there's also support from the Bipartisan Infrastructure Law to help support that. So anyway, it's an exciting time to be involved in this. So just a little bit back being in California. So you don't appreciate how fantastic our environmental laws are here in California until you live someplace else. And just simple things like traffic, our cleaner gasoline and our drive to EVs make it so that air quality here is so much better than it is in major cities on the East Coast. And I think back to, I'm sort of almost a California native. And I think when I was a kid, you could often not see San Francisco from Berkeley. You certainly had no idea that there was like a mountain range across the bay. None of that was there. So good work to all of us Californians. Anyway, I'm so happy to be in this community, in this state. So to address the issue of resilience and reliability and so forth. So today, about 20% of the end-use energy we use comes from electricity. I know it doesn't feel like that because, you know, it seems like electricity is everywhere around us. But if you look at between driving and heating and industry and all of that, that really it's only 20% that comes directly today from electricity. In the future, that's going to be more like 50, 60, 70, 80, maybe 100%. So it really highlights the importance of reliability. Because we're not going to have any choices really. So I think from that perspective, we really need to go into this thinking about built-in suspenders. You know, that we have to have redundant systems that when we are under a threat, be it from wildfires, be it from cyber attacks, be it from extreme weather, be it from an earthquake, that we always have a plan B if we are going to be so reliant on that. Which brings me to another point and perspective that we really need to think about this as an electricity system. And because of all the exciting progress about cheap solar and lower cost wind and so forth and battery storage, I think we've started to think about this as a bunch of components and certainly a lot of policy has driven towards making sure that we can deploy all these components. And the great news is they're inexpensive now. But now what we need with this sort of eye to belt and suspenders, we really need to think about this as a system and how do we build resilient systems that will make sure that we have the 24, 7, 365 energy that we need. So just to say two more things. One is that we really need to look at the distribution systems. We have a distribution system that was built on the 1960s power grid. Maybe later. It's getting better and better. But it was not built for everybody having EVs and everybody having electric everything. So I think one of the parts of resiliency is really looking, are we electrification ready on all the distribution lines within the state? And some will be ready and others will need work and we need to begin doing that work today. And it won't just be building more wires, but it will be building the intelligent control systems in so that we can manage power flows within distribution systems, including taking advantage of energy assets embedded within the distribution system. So storage systems, rooftop generation, community scale solar. How do we begin managing these as assets that again can help during periods of resistance, during periods of threats? So yeah, that's a perspective I'd like to bring to this. Thank you. Great. So what we'll do is go maybe another 10 minutes or so with the panel, and then I'd like to open it up for questions. So be thinking about questions. We'll have someone with a roving mic. So we're in a period now that I like to call the great implementation. We have set all these big goals in statute or by executive order, 100% of new vehicle sales by 2035, 100% of the electric grid by 2045, carbon neutrality by 2045. We have a 6 million electric heat pump goal. All these things are kind of set. And really I don't think there's a big need for a whole bunch of big, bold new policy. I think it's really about how do we get this done in a way that works. And I would like to just go down the line. When you think about the biggest barriers to doing what we need to do, what is at the top of the list? And from rates to, you know, reliability, I'm just curious if we could go down the line. What is it you think we have to contend with? What keeps you up at night on this question? Three barriers? Do I get 10? How many do I get? Don't take them all. Yeah, I won't take them all. We certainly talk about these a lot. I'll pick three that are, two or three that are top of mind for us. One is, and I'll say, David, I think we agree, when you look at any kind of long-term pathway study commissioned by the state, by our friends at Edison, ours, 80 to 85% of the technology is there. And so we really, really, really have to be focused on how do we innovate in scaling. Some of the things that we're focused on is, one, at the customer premise, you know, we talk about the distribution system. We have a lot of homes and multifamily dwellings in the state of California that have outdated panels, you know, and homes where maybe they have a 100 amp service and they might need 400 amps in a fully electrified future. And that gets expensive quickly, even in an affluent community. And so we're really, one of the things that we think we need to be focused on is how do we minimize the disruption and the cost for customers, all residential customers, but particularly, you know, moderates, lower income customers of those upgrades. How do we take that from a, you know, five or $10,000 plus, forgetting even the appliances, the devices, but the panel, and bring that down as little economic as possible. I think on the distribution system, we've got to be able to have a forecasting and funding and cost recovery mechanism that is much more responsive to customer demand. You know, there's so many benefits to the regulatory compact we have in California with multi-year rate cases. Customer environment is changing so quickly. You know, in terms of, we reference data center growth, explosion EVs, and so meeting customers where they are and having a whole paradigm. To Steve's point, we've had 20 years where the paradigm has been no growth. And really arguably, 50 years in California where the objective has been to destroy electric demand. We really actually now have an objective to grow electric demand. So how do we set up the whole paradigm from a forecasting and funding mechanism to do that? And then the third, and I'm sure, I don't want to steal a cylinder, I'm sure Steve will talk about this, but we have got to find a way to rapidly shorten the time frame and the cost of transmission build-out. Just under any scenario, even under the highest distributed resource scenarios where you say 70, 80 percent absolute theoretical full potential of every building in the state is blanketed with solar and storage, we still need a lot of transmission, both rebuild and new transmission. We need to find a way to really significantly shorten those timelines and reduce the costs. Nancy? Okay, so in terms of barriers, we often fight against the lack of awareness as to how compelling clean solutions can be and that they're not more expensive. There is a narrative, and part of it is because of incumbents or as David is describing, the machine that kind of perpetuates fossil fuel support and adoption. And so we often find ourselves having to educate folks that we think should kind of know better. And for example, just something that we've done in terms of the electrification of almost everything category is we've gone and looked at. When we invested in Tesla, it was like people need cars, they love their cars, but we've got to unhinge them from fossil fuels. People also feel the same way about coffee. They're addicted to their coffee and it has to be just this roast and this good, and yet the roasting of coffee is a huge carbon sink because it's all done with natural gas. Lots of particulates and these tend to be in lower income areas. And so the notion that you could unhinge from natural gas and roast coffee with electricity and distribute that is doable and there are companies out there doing that. And yet, and in fact the California Energy Commission has supported the intersectionality of decarbonizing coffee roasting with making lower income neighborhoods where these roasting companies are safer and more healthy. And they funded one of the largest roasters in the Bay Area, heirloom coffee in West Oakland, so close to 880 that you can almost touch the cars as they go by. It's a pretty rough neighborhood and yet they are a leader with the help of the CEC and a company in Berkeley called Bell Weather Coffee that makes these electric roasters. A leader in creating better coffee with a lower carbon footprint. And I find myself later today going, I'm going to have lunch with the chairman of the board of Pete's Coffee who you would think Pete's being a California company for all these years. He would be all over this and he's a very smart guy but people just don't understand that these things are doable because this is when EVs first were here, we didn't believe that you could actually have a car that was fun to drive and economical. So there is this mindset, this educational barrier that we face but we feel that working with programs like the food production program at the CEC and working with entrepreneurs who can show you the benefits of these switches that will make great progress. There is a latency there that we have to fight against. Nancy, I was just going to say we have so many options when you order coffee. The double half-calf mocha, frappuccino, all electric is the... Yeah. I'll make that. Yeah, exactly. The de-carbon coffee. De-carbon coffee. De-carbon coffee. It's coming. It's coming. Lowest carbon coffee is on the bag of Bell Weather Coffee. So again, we're all like, what? You can do this, but it really isn't rocket science. We can do it. And then another barrier that we face, and this is more of a financial barrier, but it does affect us, is some of these developments take a long time to actually achieve scale. And right now our capital markets are really rewarding, yes, revenue growth but also profitability having profits and growing them. And that's what public market investors are looking at as what they want to... If they want to buy an IPO, it has to kind of look like that now. And if you go back to 2010, when Tesla went public, it had revenues of under $100 million, which would never happen today. You could not go public at that size. And it had a loss of $150 million. Again, you couldn't get a company public today with that profile. And that is a barrier because these companies don't show up on the scene all of a sudden being perfect. I mean, it took 10 years until 2020 for Tesla to achieve profitability on a yearly basis. And I think we need to educate people that this is a work in progress, that we walk before we run, but that we have to move that direction and we need the support that we had a decade and a half ago of the capital markets and of the institutional buyers to make this transition. And so I know that's something that is a little hard for California to solve on its own, but the good news is that there are, you know, with the new transparency and carbon accounting that we're all witnessing, it is going to wake people up and educate people to the hidden liabilities in a balance sheet that isn't moving towards decarbonization and that I hope will help with this issue of how to finance these companies because as we've seen, they do need billions and billions of dollars. All right. Jason, you're right. I wasn't going to talk about transmission, but you covered it well. Oh, complete no. I mean, what's that? It's one piece. The challenge is how do you turn this grand plan into something that's executable on the ground? And they're going from concept to reality as a real challenge across every dimension here. Transmission is a great example. It takes a really long time and you can get stopped at every level, you know, at the state level, at the county level, at the local city level and being able to move forward. And you've got a lot of decision makers that are constantly challenging an individual project now have to do tens and hundreds of those projects over time. That's a big challenge that we've got to work through how we do that, the deciding, the permitting, the licensing, et cetera. Customer adoption can be a challenge. We're seeing great adoption with electric vehicles right now. We are not seeing the same thing with building electrification. We're behind when it comes to building electrification and we need more unique programs, ideas, ways to reduce barriers to build the adoption behind building electrification because that's another key part of all of this. So customer adoption can be a real challenge. Obviously, there's labor and supply chain that create both near-term, mid- and long-term crunches. Near-term, I'm more worried about supply chain. Long-term, it's getting enough resources to build everything that needs to be built. But all of those comes back to one that constantly lingers out there that we're always balancing what can be done is affordability. Affordability can undermine all of this because there are so many different investments that have to happen. Whether it's the resource side, customers having to adopt these electrification technologies that maybe they can't afford, that's the one that probably keeps me up the most at night. So we have to figure out what are the solutions. We've got to figure out how to be more efficient and effective. All the numbers I talk about in terms of the amount of grid investment, I want to find ways to reduce the amount that's needed. So how do you get technologies that, grid-enhancing technologies will get more out of your existing transmission system that allows you to get more out of every single line you put out there. Same thing on the distribution side. How do we redesign our system so that it actually takes less wires and less infrastructure to get in there? That's a big part of it. You have to look at rate design as well and getting the right signals to customers. Identifying any way you can to reduce the cent per kilowatt hour charge that a customer pays will help with electrification over time. So there's a lot of dimensions and affordability is complex, but that's probably the biggest one that overhangs that keeps me up. Great. Sally? Okay. Yeah. I want to talk about the existing building stock. So, you know, if you look at EVs, for example, or cars, where the turnover time is maybe 10 to 15 years for the vehicle stock, but buildings are different. You build a building and it exists for a long time. Today, the average commercial building in the U.S. is about 50 years old and it will be here in 2050 and perhaps much longer than that. And focusing now particularly on commercial buildings, that, you know, if you have a portfolio of buildings, sort of the typical way you do things is you make a small investment over a portfolio and it's very slow to do things like electrification or upgrading your HVAC systems. It's also extremely expensive, very capital intensive. And so one of the things that we've been trying to do to overcome that is to, and we've been using the portfolio of buildings on the Stanford campus as an experiment in that, you know, we have 180 buildings. They're everything from over 100 years old to modern hospitals and so forth and we've had the opportunity to test them. And what we've been working on is can we develop sort of a software, you know, a wraparound so that instead of having to go in and completely pull out HVAC systems and control systems, can we somehow trick the system by doing stress tests to understand, well, for this older building, what is the potential for demand response? What is the potential for improving efficiency? Just through data, so digital technologies. And what we're finding is that there's low hanging fruit out there that, you know, anywhere from, say, 15 to 30 percent demand response flexibility. We're also being able to identify that many buildings, commercial buildings in particular because of the way the systems are designed that they are using way more energy than they even need to use because one or two zones in the whole building are driving, you know, over consumption of cooling as an example. So commercial buildings which use about 35 percent electricity in the country are an obstacle and a challenge, but there are ways to overcome them. And I think we need to start pushing on, again, affordable solutions, low cost solutions, solutions that don't require capital investments, or very low capital investments. So that's one area. Another one is that, you know, people are really busy. People don't have time to think about energy.  You want to be with your family. You've got your kids. And particularly in communities, lower income communities, I think we have the opportunity to not sort of wait for every individual to make the choice that they're going to do this. But if we could develop new strategies where we go into a community and house by house and block by block, think about, well, what needs to be done here? What will it take to do it? How much will it cost? How do we develop a financing model that's equitable, affordable, and that we could implement through, you know, state-based programs or partnership programs? So I think that's in that same vein. And then I'm just going to highlight actually two more. One is this energy storage. You know, the EV revolution that's so exciting, you know, at the same time that's growing rapidly in California and around the world, EV supply chains for batteries are stressed around the world. And we have many sort of almost single points of failure in terms of where these materials are sourced from. And in a world with growing national security threats around a whole set of issues, we really need to be thinking about how do we strengthen the domestic EV supply chain. So that's one part of storage. The second part is long-duration energy storage. Certainly lithium-ion batteries are going to be a huge contribution to the California-based grid. I think they're going to be the workhorse of energy storage. But we also know that long-duration storage is going to be necessary. And today the opportunities for long-duration energy storage beyond hydropower are quite limited. So that's why at Stanford, together with Professor Chu, we've been developing a new program called Steer. And the idea behind Steer is to look deeply at these issues. What are alternative chemistries? Could we move to sodium batteries, for example? And, you know, is there a potential to make it cheaper? And how quickly can we do it? And what are the critical obstacles in roadblocks? So I think, you know, improving energy storage is really important. And then this one final thought. Alignment is going to be really critical. So we're frustrated. It's slow to permit. It's slow to get projects on the ground. Well, I think the heart of that is a lack of alignment between all the players. So as we, you know, continue this incredible revolution that the Professor Majundar talked about, the greatest transformation of our time, we really need to make sure that we've lined up things in terms of equity, economy, national security, and what's the last one here? And the environment. So often we think climate and environment are the same thing. Well, they aren't necessarily the same thing, particularly when you look at the massive amount of land use that's going to be required for all these renewables that we are going to need and want to introduce to the grid. So working on that alignment from the ground up, you know, if we can get everybody thinking, you know, working along the same path where everybody wins, it will be much easier to go quickly than if we have to do that on a case-by-case basis. Thank you. Can I just add on that? So that last point I think is a really important one. The choices that have to be made are going to be really tough because you may not be able to save all the net catchers and all the frogs and all the various, all the environmental impacts that are going to happen. You have to make those trade-offs. And right now different agencies can get in the way of decisions trying to protect what they're trying to protect. We've got to figure out a way to get all of those aligned and in some form of unison and say, here's the trade-offs we're going to make and here's the overlying umbrella that is driving that whole thing. There is an effort to take the oil and gas leases on federal land and morph them into more renewable energy sources and derive revenue from that. So that might be a solution. To be clear, I'm good with frogs and toads. All right, so let's open it up to questions. If I could ask, when you ask your question, just to introduce yourself into the panelists if we could keep the responses brief so we can get a number of folks. Before that I want to make a shameless pitch which is can I have all the Energy Commission staff please stand up for a second, which is for those of you... Lindsay, I'm looking at you. The pitch is this. For the young people, the students that are here today, there has never been a more important time to be in public service. For all this to succeed, the regulatory architecture has to be built to enable the incentives to work, the rules of the road, and that is done through our state agency, the Public Utilities Commission, the Resources Board, the Energy Commission. We are only as good as the people we get in. The opportunity is amazing. I started as chair five years ago, our budget was a billion. It's now nine billion. The good we can do, you mentioned long-duration storage, we're spending $330 million to bring that in, and we need talent. So if you are thinking about what to do when you finish your program, think about public service and try to talk to one of those CC team members. Okay, let's go to questions. Yes, ma'am, in the white. And if you can introduce yourself first. I'm Claire Broom. I'm with 350 Bay Area, an environmental and rate payer organization. First, I'd like to commend Chair Hochschild for the seven gigawatts of demand flexibility, which the Energy Commission is charged with implementing. And I can't wait to see what you do after the pool controls, and I encourage your staff. Heat pumps, heat pumps are next. Second, very quick comment. There's this bogeyman of September 6th, and the very heroic consumers who, for free, decreased their energy use to prevent brownouts. For that same day, based on the Cal independent system operator market rules, utility scale batteries discharged at 3 p.m. when there was still plenty of solar. So let's be sure we're looking at policy, not just at building more infrastructure. And finally, my question. I'd really like to hear from Nancy. To me, DERs are such a great solution to many of the challenges that have been raised. And I'm really curious to hear from Nancy what she thinks are the top, say, three policy impediments to recognizing the potential for DERs. Thanks. Thank you very much. So, you know, there's a long history of policy around distributed resources that David has been very involved in wearing many hats over the years, and we all have been. And I would say that without the policies of the California Solar Roof, what was it? Million solar roofs initiative and net metering in its early versions, we wouldn't be the leader that we are today. I think that's widely accepted. So what we're seeing today is that we're moving on because solar is not enough in terms of distributed resources. We do need storage to kind of bring the full benefits of solar to bear and to reduce the ducker, which I'm sure you guys are all familiar with. And so that led to changes in the net metering regulations, which are relatively recent. And I think we're still working our way through, because I think that the two gentlemen sitting next to me support distributed resources as much as any rooftop solar company does. But the issues of affordability and linking incentives so that we get the most bang per buck relating to solar and linking it to storage, those are all really still being worked out. And so I wish I had the crystal ball as to where that will end up. But I am concerned that some of our leading companies, I read somewhere that Sun Run laid off 2,000 people because of this change. And now we have so many problems with California people leaving and now we're having states go to Florida and all these other places, which don't have the base regulations that we have to be successful. So I guess I feel that there has to be a coming together of allowing distributed resources to thrive, making them accessible to low income areas, which we are doing and which we've always done. There was always a set aside of the million solar roofs initiative and others to give more incentives to low income neighborhoods. We can do it. It's just a matter of policy and public will. And the roles of utility, I think the utilities become so important as we move to this increased load, to this increased use of EVs as a distributed resource. So I would say that we have had a little bit of a blip in terms of rates of adoption of solar. I think that some of the incentives for distributed storage will help to bring that back up and perhaps we should couple the purchases more. Are we doing that, David? Are we creating incentives to couple solar and storage? Because I think that would be a big win. For low income, I think there's still incentives. No incentives for solar left for non-low income. Well, maybe that's something that we can look at. For the questions. Let's go to Johnny. Just project. What an August panel. Amazing. You guys have talked a lot about what happens at the local and the distributed and sort of on our whole front here. Sometimes we hear about the sort of third leg of the story being the broad regional.  And I wonder if you could speak to sort of what good work has been going on with California and other states and energy throughout the West to build out the transmission and get over the friction in the operating markets. Sure. Let me start. Go ahead. All right. So, you know, a broader West-wide regional grid will provide more diversity. It'll provide better reliability, affordability. You can spread resources out and leverage the resources that are around. The Kaiso put together their enhanced the imbalance market that's been operating now for a number of years. And you've got a huge amount of the load in the broader West operating in that, basically the real-time market. And there's been, I think, four or five billion dollars of benefits to customers from that market. Now, the next steps are extending that to a day-ahead market. And so the California Independent System Operator recently got their EDAM, as they call it, Enhanced Day-ahead Market, designed and approved by FERC in December. And the plan is to have that go live in 2026. So we're looking to build that day-ahead market out, which will, you know, right now, less than 10% of your energy is clearing the real-time markets. You go to the day-ahead, and now you're getting more than 90% of it, so a lot broader benefits. The operation of those markets really helps when you get in the crunch time during summers. And so each summer of the last few years, it's actually been different parts of the West that have benefited. In the past, California's had to import a lot, and that visibility and the flows has helped California. This past summer, the Desert Southwest was really hurting, and they benefited significantly from actually drawing resources from California elsewhere during their peak times. And so as you broaden out those markets and go beyond just a real-time or a day-ahead market and begin to look at system and transmission planning and a full regional transmission operator, there is a lot more benefits. Those benefits are smaller if you've got multiple markets. And so part of what we're looking at, as well, is how do we get to a single West-wide market that will drive efficiencies and reliability and, frankly, put more resiliency into the West? I'll build just real quick building on Steve's last comment on resilience. You know, traditional power system modeling right from an engineering perspective and then looking at the economic benefits from an affordability and then managing reliability, we don't actually yet have a paradigm for how we really plan for or value resilience. You know, traditional one-in-ten loss of load planning doesn't account for the types of things like we had in 2020 or we're going to continue to have with these compounding events, right? You have, you know, a fire on the northern California border that results in some transmission lines needing to come down. You've got smoke, solar production's down. It's hot, people are running AC, they've got EVs. We've seen it, right, in terms of these events kind of pan-caking. And I think we know we're going to see more of it around those kind of compounding variables. And so I think we don't yet have a good way to put a price tag on that, but we know it's high. And so I think the resilience benefits are there. We also need to be keeping our eyes open for alongside, to Steve's point, the reliability and customer affordability benefits. Okay, next question. Okay, go ahead. My name is Miss Margaret Gordon. I'm the founder and the co-director of the West Oakland Environmental Indicators Project. What I would like to hear, where is the plan of action to talk about the justice and the injustice and regarding those who are most vulnerable and impacted for not having all these required or these proposed energy efficiencies to be a pathway to net zero. I haven't heard of anything that where's the community-driven process from Stanford. Where is the expectation that there will be something that will be more supportive of the targeted neighborhoods who have the most impact? And also, where's the health piece in this? Because we pay what I have every day by being exposed. And I'm not hearing anything like that from this panel or from you as the emcee of it. Yeah, ma'am, with your permission, I can respond to that, so that's a very fair question and actually there is good news. Sorry? Yeah. So let me share what's happening on that. So the state of California is absolutely embedding equity in every single energy program. You mentioned air quality. So one of the key things for indoor air quality is natural gas stoves. So we're doing a billion and a half dollars in incentive money for people to convert. That 100% of that money is going to low-income households. Of the $4 billion we're doing right now for electric vehicle charging, we set a goal at the Energy Commission to do 50% in low-income communities. We're doing 68% today. In our demonstration projects that Joan is leading, we're doing about a billion and a half dollars for clean energy projects such as energy storage. We're at about 70% in low-income households. And then for things like solar that used to be incentives going to all income classes, it's only going to low-income, there's a lot more that needs to be done, a lot more. We recognize that. And I think one of the things that is a particular pain points around power generation. I grew up in the city of San Francisco. We had two power plants. They weren't in the wealthy neighborhoods. They weren't Pacific Heights or Marine District. They were in Hunter's Point, Bayview. And Ms. Espinola Jackson is one of my mentors in San Francisco. And she led the fight really to get those shut down.  About 40% of our gas fleet in the state of California is still in low-income communities. And we're not going to stop until that's done. I don't want you to get the impression we're satisfied with that, but I do think it has been a seed change. And I would say this. I think what California has done on this has affected the Biden administration. And now the Biden administration has implemented a larger point, like what is the goal? It is, in addition to getting to 100% clean energy is to do it the right way. And this is not just for urban communities, but also for tribal communities. We have a big program. We have actually 20% of the Native American tribes in the United States are here in our state of California. We've done eight tribal energy microgrids, including two $30 million grants to support tribal energy sovereignty. So I see that as a down payment, but not the end of the job. Any others, like Sal, you want to add to that? Sure, yeah. Anyway, thank you for bringing this up, because absolutely it's incredibly important. I want to just highlight a couple of areas where Stanford faculty have been leading in this area. And then I'll talk about some of the new programs that are taking place. So one of the big issues is how do you prove and quantify the impacts of power plants or even on-road transportation on different communities living in different parts of the state or the country. And Professor Azevedo is one of the leaders in developing the tools that were able to quantitatively demonstrate, beyond any doubt, that in fact that low income and community of colors are disproportionately impacted by pollution. So that, I think, is very important work. We recently just did a study showing that, actually from a California perspective, we import still coal-based power generation as well as natural gas power-based generation from other states. And we were able to actually show that our imports, again, disproportionately are impacting a low income and community of colors even beyond our own state borders, which is something that we need to do something about. So that's some past work. Saying a little bit more, Holmes Hummel, are you here, Holmes? Okay, Holmes. Holmes is one of our leading researchers working on these issues. So I encourage you to speak to Holmes, a fantastic leader in that area. The second thing is tomorrow we are having another companion meeting to this on a new program that has been initiated called Ernest where we're working with a consortium of universities around the country on equity-centered, equity-focused energy transition strategies. And again, Professor Ines Azevedo is leading that. So I'm not sure if you're planning on being here tomorrow but do get in touch and we'll find a way to keep hearing from you more. Well, thank you. We'll follow up. Nancy? I just want to offer it's so true that West Oakland has disproportionately high respiratory disease because of particulates and such and while it takes a huge effort to turn that around I would invite you, if you're interested in a coffee roasting company that is in West Oakland, heirloom coffee that's a pretty big employer in that neighborhood if you'd like to visit and see how the natural gas roaster in all of its sort of noise and particulate generating glory is being replaced by silent ventless non-polluting electric roasters and creating great power and being supported by the California Energy Commission I would love for you to see it and perhaps bring some of the members of your organization and start to build that partnership that you've talked about. Thank you. Let's try to go a little faster. We've got seven minutes left. Ma'am in the black, go ahead. Good morning everyone. Dr. Glaude Casada I'm with the State Treasures Office the California Clean Tech Financing Authority we love the CEC, we love Stanford we love Proverb, if you want to go fast go alone, if you want to go far go together I wanted to ask the panel what they feel about building emissions saving ordinances and how jurisdictions can be more part of the solution in conjunction with community groups to ensure that these ordinances are followed at the point of sale which is very progressive. It will impact the large commercial owners, the residential owners that are turning over these properties possibly for profits SOBESO, SOBESO is very popular in Berkeley building emissions saving ordinances if you could speak on that and how you think it's part of the solution. Anyone want to speak too? I'm sorry. Building. Building ordinances. Oh sure. I mean it's very important, obviously Berkeley was the first ordinance to call for eliminating natural gas in new buildings and many many other municipalities followed that and states now are leading the charge however the courts did undo that ruling a few weeks ago or a month ago so that is a setback but I don't think it undermines the central point is that so much can happen at the level of building codes and ordinances we've seen that time and time again when Gavin Newsom was mayor of San Francisco he passed one of the local ordinances promoting solar energy and all of a sudden put San Francisco on the map so there is a cloud future in some of these ordinances because they do tend to get politicized and then land into the courts where I just don't think it's a center of expertise and so you don't see the decisions necessarily being supportive but for us they're a leading indicator when we make investments, when we see things like Berkeley or other ordinances coming together and do the analysis and look at the market we're very very mindful of the importance of that activity. One little story to tell just in 2019 the commission adopted a solar mandate on all new homes so we built about 100,000 new homes a year and I don't think that would have been possible had not cities we had seven cities that went out ahead of the state and did a solar mandate ahead and so now there's about 75 cities that have done some form of all electric mandate or all electric ready mandate and that really is a seed planting exercise for the state code. This to me is the prime example of what Sally was talking about in terms of alignment and we talked about it in the electric transmission context but how do we to your point that seed planting and create some commonality whether that's in code or even preceding code changes having some commonality so that frankly as a dual fuel utility we're not winding up with 75 different versions of how to implement building electrification because that becomes very very challenging creates equity issues who wind up with this kind of we call Swiss cheese and risk of stranding infrastructure so this is one that we're very keenly attuned to finding a way while respecting local jurisdictional authority creating some alignment at the state and county level as well. Okay, Min, let's go to you. Hi, Commissioner Hotchow spoke earlier about the great California climate experiment and how others are looking for us to fail. What I worry about is actually not just the resiliency and reliability and I want to commend Steven for talking about the affordability that is front of his mind because what we're seeing are double digit rate increases and while Californians pay two to three X times more than consumers and businesses in other states for the poor KWH for our electricity our buildings are more efficient than others so how do we reconcile the investments that we need to make we know we need to make in terms of grid infrastructure, distributed resources and transmission lines and distribution lines and substations, how do we reconcile those rate increases with what we're telling the public in that this transition is going to actually save them money okay, I mean EIX, SEE, talked about your pathway to 45 where consumers actually are going to save money in the long run but we're seeing double digit rate increases how do we reconcile those two? Do you want to go for it? We had the most recent GRC from PG&E so let me comment on this the end game we have similar analysis to Steve's team the end game is very attractive in terms of being able to shift the money that's spent on gasoline and other liquid fuels into the electric system because it's just so much more efficient how we get there who pays, how they pay when they pay we got to find a way to answer all those questions I think we the most recent rate case that we worked through are all vital safety investments a bunch of it is catch up on some wildfire spend but I do think it's also indicative of how the path to that attractive end game can hit some bumps along the way and I'll just reinforce what Steve said that we're very very focused on trying to make those bills as affordable as possible that show up on the PG&E or SEE or SDG&E letter head showing up in customers inboxes every month and also I think we need to have a real conversation about what do we want on the utility bill, what do we want showing up being paid for in other ways that we don't yet have a you know a consensus around did you want another question you want me to close this can I just give point a little factoid and we have to leave no stone unturned because when we talk about the cost of wildfire the more foundation just came out with a study that showed if you can get to fires earlier you could save anywhere from three to eight billion dollars and so investing in our infrastructure to eliminate the catastrophic spreading of wildfires not only saves lives and habitat and ways of life it's saved billions of dollars and it's all within reach couple quick points so our analysis says by 2045 you should see a 40% average customer will see a 40% reduction in their total energy spend we have to think about total energy spend not electric bill energy spend is gasoline natural gas and electricity combined yes electric bills will go up by 2045 to help make all this happen but you're spending so much less on gasoline and natural gas to get through this transition we also have to be really clear on what's driving increases at certain times we've had double digit rate increases for four or five years in a row now it is primarily driven by wildfire investments and so it has not been the clean energy transition that is driving those increases that we're seeing we don't we have to make sure that people don't say that hey the rates are going up the clean energy isn't working no that's not what's happening here we've got a midterm period where we have to spend to fortify against wildfires and drive that resiliency once the grid is hardened it's maintenance from there that's when you've got room and bills for the other pieces so important parts that it's easy to take the messages and mix them up and say this isn't working that's not the case we've got to make sure that we're focused on that total energy spend and the transition and we do have to find every single way we can to make it more and more affordable all right with that friends will you join me in thanking our terrific panel


From the airmen on the flight line, doing CDCs, to some of our most senior officers taking courses here at the LeMay Center, to the top percentage of our Air Force officers going through ACSC or Air War College, to 85% of the officers being assessed through Air University through OTS or ROTC. We hope to give you that thirst, that spark. You may not get it in the 30 days school, 30 days that you may be here in some of our short courses, or you may not even get it now in our 10 month long courses. But we hope to give you that thirst, that when you walk out of the gates of Air University, regardless of if it's here on Maxwell Gunner, Afford or any of our locations around the world, develop a thirst to know more, learn more, study more, do more. But that thirst to go out and be innovative, to be creative, to be groundbreaking, that's Air University.


Hi there, welcome everyone! We're here with Dylan and Allison, who presented here at DEFCON Safe Mode on Lateral Movement and Privilege Escalation in GCP. Compromise any organization without dropping an implant. And I have to say, one of the highest theatrical production values I think I've seen so far in a video, including the hacker with the hoodie doing the whole, you know, hey, let's just pound on things, but with the real hacker. So it was pretty entertaining to say the least. So welcome, both of you, to DEFCON here at Safe Mode. Thank you. It's great to be here. Thank you. Yeah, so first thing I want to kind of ask, just to get things started. So really, right, you like, has anything changed since the DEFCON, since you recorded your DEFCON talk and it was published? Any major changes or anything you want to share with the DEFCON community? Yeah, so there are actually a number of changes that Google's been rolling out, all of which have been super positive. Oh, it looks like Allison's video cut out. I guess she'll rejoin. I'll be answering the question, though. So I guess most notably, the service accounts or the roles and permissions, which can make use of the default service account without act as are being end of life in 2021. And that was a direct response to this talk. And what that means is you will need the act as permission in addition to the other permission in order to do the action of attaching a service account to those services, even for the default service account. So that's going to change things a little bit in terms of what the overall security story is. I'm not 100% sure because it will lead to the proliferation of the act as permission. Ideally, folks will be applying that at the resource level for these privileged scope service accounts, but like we showed in the talk, people will often apply it at the project level. So it sort of opens the opportunity up for you to make yourself more secure, but it also kind of opens up more foot shooting opportunities. Another interesting change was that the very quick clip that I cut over to GitHub for and showed a bunch of people uploading their GCP service account credentials. I noticed that when I ran the same search on GitHub, those keys are no longer there. I assume someone went through a lot of effort to get those removed.  So those keys are immortalized in some capacity, but it's good that they took them down. It makes it more tricky to just immediately exploit lots of people at the gate from the talk, and I'm glad they did that. Awesome, awesome. Yeah, so kind of another kind of thought provoker. So as I watched your video, I liked kind of at the beginning, how you're like, here's how AWS identity access management works, right? And kind of here's the GCP model. You know, based on your experience so far, like I guess, do you think one is better? Right? Do you prefer one model or the other? Do you think they both have their place? Kind of what's your take on that? That's a good question. There are definitely elements of the GCP platform that are unique and nice to use that AWS doesn't have. But in terms of the IM story, I would say generally speaking from what I've observed, AWS more follows the principle of least privilege than GCP. And in that context, I guess it depends on your perspective. If you're a brand new developer and you want to move really quick and you want to have everything open by default, GCP is an interesting choice. If you're a security engineer and you want to follow this privilege and lock things down, AWS from my observations tends to do that more. So actually there's a question in the chat that kind of goes into that. So I'll go ahead and ask it. It was for those of us with existing and sprawling GCP environments, given that the org policies aren't retroactive, what are some good approaches for tackling remediation for those deployments? That's a really good question. And I think we wanted to go into a little bit more depth into that subject in the video, but we didn't have the time to really dig into it. Remediation is really tricky. So you can enable org policy when you're first starting an organization or later. And for all new things going forward, they'll get the benefits of it. But for all the existing projects that are already using the default service account, it's really hard to win yourself off of it for a couple of reasons. First is that if you switch service accounts on a live VM, which a lot of services are powered by, that VM needs to actually be stopped and started again to get the new service account. The second is that the default service account is kind of like it's not just like a set of permissions that's applied to your services, but it's also an IM policy that's shared across all of your services. And so you have two different services using the same policy. If you want to make modifications to that policy, it's going to affect both services. So that makes it a little bit tricky. And then the way service accounts work is you can both use them as keys and you can use them as attached identities similar to AWS. And so you have to kind of enumerate all the different use cases and kind of systematically knock them out one at a time. So you have to see how many keys are exported. You have to see is it attached to any instances. You have to check the stack driver logs to see whether or not they're in use. All of that can be really tricky, but some tools that do help with that are the Asset Analyzer API to see where the default service accounts are in use. And then the other one that's handy is the role recommender. So you can get some idea of based on the last 90-day look back period for a given project, how many permissions has the default service account actually used. Now, that's not the whole story for a number of reasons. One of which is the role recommender will only apply those recommendations sort of, you know, if the role binding is at the project level, it'll make the recommendation at the project level. It won't make the recommendation down at the resource level. And it also won't recommend that you split your IAM into two different, you know, identities. If maybe multiple services are using the default service account, it'll make a recommendation based on the summation of all those services. It won't say this service should have this scope of permissions and that service should have that scope of permissions. But it does kind of go a long way in terms of very quick remediation that you can do for looking backward for the things that work policy can't cover. Cool. Yeah, so I kind of had a thought too. So as I was watching this, I was like, man, this seems like a cool way for, you know, an attacker to maybe gain persistence in one of these, you know, GCP environments, like, you know, setting up an account and, you know, maybe before some of these changes like, hey, could you set up an account, give it privileges and then does it just fly under the hood? I guess what's your thought around that? Like, could you see that as a potential attack vector or would you see maybe other kind of attack vectors for hiding in the IAM noise of GCP? Yeah, I mean, I think a lot of what we showed is that this lateral movement, privilege escalation, persistence, it can all be done without dropping implants on a server. Like you might for act as want to spin some things up, introduce them into the environment, but for servers that have maybe end points off for monitoring malware and things like that, it wouldn't set those things off. So I think it is good for persistence in that way. We'll probably need new tooling to look for these types of attacks. One of the services that Google offers to kind of help with this is the, I forget exactly what it's called, but it's a service that will monitor your stack driver logs and look for bad things and then alert you if it sees bad things. And so it's watching those cloud APIs, which will be auditable. And examples of things they've used in the past are like known bad IP addresses for like crypto miners that they ever show up in your stack driver logs so send you an alert, but I expect these types of cloud attacks will become more and more a piece of that story. We also briefly showed a lot of phishing. I think that's also a great way for persistence because if you get somebody to click and allow link on wide scope open permissions, you can get the permissions of the user without having to get a service account credential and it functions the same way. So that's another way that you can sort of use these same techniques and get persistence. Something to note on this too is service account keys. So if someone is able to create a service account and give it access to a resource or something, a project that the service account keys last for 10 years. So if they're never rotated by the organization or deleted, then you have that key for a very long time. Wow, definitely interesting. Oh, another quick note on that. The long lived exported credentials last for 10 years like Alice mentioned, which is interesting. The short lived instance credentials, those last I think closer to 10 minutes, but that'll persist after an instance is terminated. So if you're an attacker and you're exploiting something like an SSRF or even remote code execution, grab instance credentials, even after the defensive person deletes the instance, the attacker can still persist another 10 minutes. Okay, so we had another question pop up here in chat and kind of along what your follow up to what you're asking or explaining says, what about abandoned service accounts? Say they're deleted. Do you end up with abandoned ACLs that exist on the resources and projects? That's a good question. Alison, did you want to take that? So there's actually something that is kind of interesting about this where we've run into some bugs actually where a service account has been deleted and their IAM bindings were also removed. So if a service account is deleted, the IAM binding can still exist there. So maybe also a user, if you have a user in your org and you remove them from G Suite, that IAM binding will still exist in your GCP projects with user at gmail.com or whatever that is. But there's also interesting things that can happen due to the undelete capabilities for service accounts where if you delete a service account, IAM binding, like you asked, it still exists where that IAM binding was made. And if you try to undelete your service account, you're like, oh, maybe I actually need that and you had, or you try to create a new service account with that same name. The IAM binding will reference the UID of the service account that was deleted. So you can have this weird like caching thing happen where you'll get like permission denied errors. If you're using the service account A and I give it an IAM binding of my project and I delete it, then I recreate a new service account, service account A. It tries to reference that existing IAM policy. It doesn't work because it's referencing the old service account that was deleted by its unique ID. So yeah, they exist and this can bring up some really weird bugs. If you're trying to create new service accounts with the same name or undelete your service accounts and you're not updating the IAM policies in parallel. Cool. Yeah, so we kind of talked about this a little bit and you mentioned this in your talk too, kind of from the defender perspective, right? Like they just rolled out like the IAM analyzer, there's the recommender. You know, I guess, are there any other things or advice you'd give to blue teams looking to secure kind of the GCP environment, right? Or the IAM offerings, like detection opportunities, like the tool you mentioned, log analysis, like, are there any good things to try to really dive in, like, hey, you ingest this log feed and, you know, hey, we'll see all your IAM transactions or anything like that, any advice you give. That's a good question. A lot of people will recommend that you can pipe your stack driver logs over to BigQuery so that you get a structured, queried language that's a little bit easier to work with than the filters in Stackdriver. Easier to write detection rules for and such. I think that definitely the security API that exists at the org level has some very interesting introspection that you can do across your whole fleet, and they provide some suggestions and recommendations around other types of lease privilege, like pockets that were left open to the Internet and things like that. There's also a lot of other org policies that we didn't cover that also will improve your security story but just aren't necessarily related to the content we talked about, like allowing your developers to add users outside of your organization to roles inside your organization, but that's allowed, so you can add a random Gmail account to a project. You can disable that via org policy. So it's definitely worth checking out those high-level org policies as well. And I think that we mentioned this as well in the talk, but we had general positive experiences providing feedback to Google, and in some cases they actually put us in touch with PMs where we could explain these issues directly to them, and so in that regard, we strongly recommend people to engage with Google around pain points and tell them what an ideal workflow would look like, and in our case, they were very receptive and worked with us on those things. Yeah, I was actually going to dive a little into that too, so again, working with Google that closely, it's always an interesting thing of when you're approaching someone with base-level issues like that, how do they respond? Do you have any other tips for folks who'd be in similar situations, like reaching out to a Google or another company? Anything you learned out of that that you'd do better next time? Well, I think what was interesting is there's kind of two ways to engage with Google. There's the customer way, and then there's the vulnerability way. So you can submit to their bug bounty, and they get a very binary, this is a problem, this isn't a problem. If it's a problem, they'll pay you and they'll fix it. If it's not a problem, they'll close the ticket and that's the end of the story. That's the bug bounty way. And you're interacting with the security engineer when you do that on the other end of that ticket. When you go the customer route, you're talking with a PM around them building products and giving them feedback about existing products. And that's a continuous story that doesn't end and it's not binary.  And you get to continue that conversation indefinitely. It's not a binary, this isn't a problem, this isn't a problem, okay, ticket closed. So we pursued both of those paths concurrently. And I think that probably depends on your particular use case. But there were some things which we submitted as bugs through the bug bounty and we thought that they would just be recognized as bugs and fixed. But they were actually just closed out as working as intended. And for those things, going the customer route actually proved to be more effective. That's great advice. Great advice for other people. I guess the other question I have too, what's next, right? You kind of really, I guess, gone into a lot of the problems here. You've done a lot of improvement on this front with Google. What's your next for the research front? Are you going to continue to refine more attacks here, looking at other things? What's next for the both of you? So recently I did notice someone sent me some good resources that Rhino Security wrote up and they released some proof of concept tools. I think it would be cool if the community helped bundle all of those tools into one framework. Of course, I'm selfishly hoping that's G-Split so that we can kind of have a metasploit for cloud. So I thought that that might be fun to consolidate some of that stuff. But beyond that, we don't have a lot of plans to do more of sense of work in GCP. What about you, Allison? Yeah, for public research-wise, I don't think I'll be elaborating on this topic for a while, but definitely something that I'm personally interested in, learning more about and seeing the state of how different cloud providers, Google and AWS tackle I am, because it's something that's really difficult and I think it's going to be changing very frequently for a long time, because it's such a hard problem to try to tackle. So no public research for the near future, but definitely interested in seeing what happens. And I have a question that kind of came up when I was watching your talk as well. Kind of going back to the tooling, you mentioned that you all developed a framework, G-Split, is that something that has been, are you planning on releasing anytime in the future? Oh yeah, it's already live. We linked to it in the talk, and you can check it out. It's on GitHub and Docker Hub. So it's just a little Docker container you can run. It was definitely released more on the proof of concept side than production code side. So some people found some bugs in it already and expecting more, but it does the things that we videoed. So those demos, you can reproduce them with the tool. Cool. And then it looks like we have one more question in the chat. From your talk, I got the idea that in AWS, the account holder owns the permissions, but doesn't that cause a problem for research owners who need or want to provide permissions when the account is not under their control? I think this kind of gets at the heart of what we open the talk with, which is whether or not your IAM model is resource centric or user centric. So is it basically the resource owner that controls who can access the resource, or is it the identity owner that controls what resources that identity can access? And I think that's sort of the main difference between the two IAM stories in AWS versus GCP at least that we opened with. We talked about some of the challenges that come up with the resource centric model that's in GCP. We didn't really touch on the challenges of the inverse of that in AWS. And to be honest, I'm not an expert in AWS IAM by any means. And so I'd be curious to know if someone else wanted to do a deep dive on those cons are. Yeah. It also depends on how you're managing your infrastructure. It depends on like, are you allowing engineers to manage different infrastructure configurations, or do you have kind of a more centralized way that you're provisioning access within an account to something to think about? Cool. Yeah. I guess one thing I didn't really ask there. I don't remember is like, why GCP? What kind of drew you to this area for research? Why did you look at this and the weaknesses here? Well, I think some of the defaults were definitely a little eye-opening. I guess the full story of this is someone briefly compressed down in the back of an Uber ride on my way home.   Yeah, all these things run as almost full administrator by default. And those things kind of prompted me to poke into it a little more. And then I think my poking got Allison poking. And then we just followed the rabbit hole as far as it would go. Yeah, there is one other question here that just came in the chat too. And I don't know if you know the answer, but which model does Azure take? Is it more resource or identity centric? Actually, not sure. Not the only one with Azure. Very much. It also wouldn't be able to speak to Orville Cloud, IBM Cloud, or Alibaba Cloud. But I'm very curious to know the case for all of us. Future research for others to look into. Definitely. Awesome. Yeah, so we're getting near the end of our time here. But really a couple last final ups. First, what should people look into if they're interested in learning more kind of about the GCP identity access model? And where would you recommend someone start if they're trying to figure out how does this work and maybe if they want to dive in themselves? Yeah, there's actually the documentation I think is really great to start with. Really just read it in its entirety. It's a lot of information. But from like a hardening perspective, Google also recently released a new blog post that outlines some of the, in one kind of place, not in each individual services, IAM docs, some of the different steps you can take to harden the IAM of the different services that we brought up in our talk. Oh, yeah. And on that subject, that blog post is also an answer to earlier questions of what they've done since the talk. That blog post was done in response to the talk. Awesome. Yeah. So someone said GCP is like gone cloud pining, which seems pretty apt. Yeah. So really, I kind of opened up the last user. Anything else you really want to share with anyone? Any other last thoughts, things that you think you folks or really should know about GCP before we move on? Well, I'll just share that I am completely new to Twitter. I made a Twitter account last week and I shared the handle in the video. But if folks want to connect with me there and make me feel less lonely because they don't have a lot of followers, feel free. What Twitter account is that? Oh, it's insecure nature and it's linked in the talk and I can also link in that chat. I guess my final thought would be don't trust the documentation. I know I said just read the documentation but don't trust the documentation. Like when you're going and assessing things or building things, take kind of like a reverse engineering approach to analyzing things in the cloud. So test and verify the behaviors. Maybe just take what's in the documentation or what you think it would work, how you think something should work as the truth. Oh, yeah. And there are also a couple more privileged escalations. Like I mentioned that we just didn't have time to go into. We covered most of the ones that compromise like a large set of identities, but there are privileged escalations for getting access to storage and those types of things. They're covered both in our earlier talk that we gave at B-Sites that I recommend folks check out. And like I mentioned, Rhino Security has done some pretty good write-ups recently on it. Awesome. Well, thank you both Dylan and Allison. Really what I'd suggest too, if you have any particular links or summarized list of links you want to throw into the Discord chat room that'll be helpful for everyone. There's lots of folks in there thanking you for the talk. So definitely well received by everyone here. But yeah, just want to say thank you again. Thank you for joining us for the DEF CON safe mode talk. Thanks for presenting in these weird times and hopefully see you in the future out in Vegas when we return. Sounds good. Thanks so much for having us. Thank you so much. Yeah, thank you. It's a pleasure. Yep. Take care. Yeah, thanks.


Hey friends, welcome back to my channel and welcome if you're new here. Thank you so much for clicking on today's video. My name is Jen. I am a certified nutrition coach and I follow the WW Blue Plan. Today we have meal prep. I put out a meal prep video every single Monday where I share three absolutely delicious calorie friendly, point friendly, healthy nutritious recipes for you to recreate for yourself for the upcoming week. You will find all of today's recipes on my website which is linked down in the description box below. Also in the description box, you're going to find my nutrition coaching website. So head over, check it out, take advantage of a lot of the different coaching options that I have for you to help you on your healthy eating, your WW, your weight loss journey. I would love to help you along the way. Also you're going to find links and discount codes to all my favorite things as well as the link to head over and join my public Facebook group, Jen's WW Tribe. So we'd love to have you join that community over there. So make sure you're checking out that description box. If you are new, stick around, subscribe, hit the little bell next to it so you're notified whenever new videos are uploaded. We would love to have you join our YouTube community as well. Give this video a big thumbs up if you enjoy meal prep and let's jump in because we have three incredible recipes this week. Breakfast this week, I am making chunky monkey quinoa breakfast bowls. I'm excited for this. It's a great way to get in some healthy food like quinoa that has complete protein. You get a chocolate peanut butter banana goodness. I can't wait for this. So let me show you what's in our breakfast. First you're going to need some quinoa. I have this organic royal white quinoa from Imperfect Foods. You guys know I love Imperfect Foods. I will link it down below with $10 off your first box. They have more than just produce, you guys. I get tons of new food finds from them and I am excited to try this quinoa. Super affordable and it helps eliminate food waste. So highly recommend checking out Imperfect Foods. You'll also need some non-dairy milk. I have this forager cashew. You can use cocoa powder or cacao powder. I prefer cacao powder. It's just better for you. It's nutrient dense superfood. So I always substitute this in place of cocoa powder but use whatever you have on hand. I'm also using some maple syrup. I love this syrup from Thrive. Thrive is also linked down below. With a membership, you get a free gift up to $22. So I love Thrive. You guys know I order from them all the time. And then I have some organic PB Fit.  So let's make some breakfast. So the first thing we're going to do is add one cup of quinoa and two cups of water to a pan. We are going to get this quinoa cooking down. Once this comes to a boil, we're gonna go ahead and pop a lid on it. Put it on low heat and we're just gonna let it be for about 15 to 20 minutes or until our quinoa is nice and fluffy. So the quinoa is done. Now we are just going to add all the rest of our ingredients directly to our pan, starting with three quarters of a cup of almond milk. And I'm gonna give that a quick stir just to get that kind of mixed in and it'll kind of help cool down the quinoa so it doesn't fog up for you guys. So I'm gonna go ahead and mix that in. This pan of quinoa and toppings that we're adding is going to make four bowls. So four different breakfasts. We're also going to add in our PB2. This is four tablespoons. I went ahead and measured that out on my food scale. Also three tablespoons of the cacao or cocoa powder, whatever it is that you're using. And then I have two tablespoons of pure maple syrup. Also measured out on my food scale. And last but not least, one mashed banana. We're going to stir this all together.  It's like chocolate peanut butter deliciousness. Oh my goodness, okay. So we're gonna mix this all together. I'm gonna let it sit here on the stove for just about two to three minutes. I wanna make sure that all the flavors of the chocolate and the peanut butter and everything get kind of melded together. And then we'll get this out into bowls. I'll give you points and calories. And we're gonna talk about what we can top this with for a little added extra pizzazz when we go to have this for breakfast. So again, this makes four breakfast bowls. Look how good this looks. It seriously smells so good. So I'm just going to divide it out. In my four meal prep bowls as evenly as I can. And then I'm going to show you some topping options. We'll talk about some things that we can top the bowl with for zero points, as well as some things that we can top the bowl with that have additional points. If that's kind of the route that you wanna take. And then I will give you the points and the calories for just the bowl. And we'll go over points and calories for the toppings as we talk about them. So here is the completed bowl. So this is a good amount. And quinoa is very filling. It is a complete protein. And with adding in the PB2 and the cacao powder it should be nice and filling. So I wanna talk about a few options for some toppings. That would be really good with this. So first you could do coconut flakes like unsweetened coconut flakes. This would be really good to add to the top. You can usually have a tablespoon for one to two smart points. So you could pop on some coconut flakes. Also some additional chocolate because who doesn't want some additional chocolate? So any type of lilies or bake believe or any type of chocolate chip or even the new butterscotch chips or white chocolate chips from lilies would be really good on there. You can also add a little bit of butter, nut butter. So this is cashew butter. You could do peanut butter. You could even mix up some extra PB2 with some water and pop that on top. If you want a zero point topping you could slice up an additional banana into little banana coins. You could do berries, blueberries, raspberries, strawberries would be so good on there. Another option is adding some of your favorite granola to the top would be really good as well. And lastly, how about some jam? I have some blueberry jam. You could really do any flavor of jam and just jazz this up and make a perfect delicious breakfast. So our chunky monkey quinoa bowl as it sits with no toppings just the bowl itself is going to be seven points on both the blue and the green plan. Only three points on purple just because you don't have to account for the quinoa which is a big portion of the points. But what's crazy you guys this entire bowl is only 214 calories. So if you are strictly calorie counting that is really low for breakfast. So you could certainly add some of these additional toppings and be well within a good caloric range for a breakfast. So 214 calories, seven points on blue and green, three points on purple. For lunches this week I'm making feta and sun dried tomato turkey meatloaf. We're going to pair that with some mashed potatoes some green beans. We are going to already bring in comfort food because we're in fall. So let me show you what's in our meatloaf recipe and then what I'm going to have on the side. First you're going to need some sun dried tomatoes. Make sure you get them not in oil so that there's zero points. You'll also need some almond milk or cashew milk, minced garlic, breadcrumbs. You'll need a couple of egg whites, a pound of 99% lean ground turkey. You can use fresh parsley or dried parsley, feta cheese and salt and pepper. And I'm going to pair my meatloaf with some of these frozen Trader Joe's mashed potatoes. These were in my freezer. So I'm going to use them up. They're the little pellets. I'll show you guys what those look like and we'll make sure that we weigh them out so that we have justice serving in each of our meal prep containers. And then I'm actually going to have some green beans. Again, I'm using up what I have and we'll add some green beans to each day's lunch as well. So let's get started on our meatloaf. So let's get started on the meatloaf. So we are going to add all of the ingredients to our bowl with the exception of the turkey. We're actually going to add that last. So I have a quarter cup of the sun dried tomatoes. I just kind of roughly chopped those. You don't even have to chop them if you don't want to but I wanted them to go a little bit further. Here are my two egg whites. And then I also have some minced garlic here. We're going to put in about three cloves worth of the minced garlic. I thought we could just grab a spoon and just put a good chunk of garlic in there. And then we have one half of a cup of breadcrumbs. I'm using panko. You could use regular breadcrumbs as well. We are going to season with a little bit of salt and a little bit of pepper and a little bit of parsley or a lot of bit of parsley. I'm going to put in about a tablespoon of dried parsley. I have one half of a cup of feta cheese crumbles. I used full fat. You could use fat free feta and cut down on the points if you want to do that. And then two tablespoons of the almond milk. So let's first give this kind of a preliminary stir. Get that all mixed together. And then we will go ahead and add in the turkey. This smells so good. Look at that, you guys. Yeah, okay. So now we're going to add in the 99% ground turkey.  I did that on purpose because our breakfast is a little bit higher. So I like to balance it out if I can with a lower point lunch option or vice versa. A low point breakfast and a higher point lunch. Sticking with full fat feta helps a lot because it just makes it a little bit more moist because we are using 99% ground turkey, which can be a little bit dry. And also adding those eggs as well as a little bit of almond milk will make a difference too. But oh my gosh, this looks incredible. Let's grab out our meatloaf pan and get this into the oven. So once you have the meatloaf combined, go ahead and grab out your meatloaf pan. Spray it with some nonstick cooking spray and we are going to add the meat mixture directly to our meatloaf pan. Press it down so that you get that nice loaf shape. And then this is going to go in the oven 375 degrees until it is cooked completely through, which my guess will be about 20 to 30 minutes. You just wanna make sure that that turkey is cooked all the way through. So let's get this spread out in the pan and into the oven. While our meatloaf is in the oven, I'm gonna go ahead and put together the sides for meal prep. So I have my three compartment meal prep container. I will link these down below for you guys, all the different ones, the bowls, the three and the two compartment. In one of the small compartments here, I'm going to add my mashed potatoes. This is all I have left. So I'm going to divide them out as even as I can. And then once we put the meal prep together, I'll tell you how many points worth of mashed potatoes I have. When I go to warm these up, I am going to add just a little bit of water. That's all you have to do is add a little water to the pellets and it makes perfect mashed potatoes and it's really, really good. So I'll do that. And then I'm also going to add my green beans. This is two cans. So my plan is to go ahead and put one fifth of the beans in each container. I'm putting together five lunch preps total. The meatloaf makes six servings. So five of those will be for my lunch. I'm going to start with five pellets. Actually, let's start with six pellets per meal prep. Again, I don't know if I'll be able to add more once I put together the rest, but let's get all this part done, our green beans and our potatoes, and then our meatloaf should be done. All right, here's our meatloaf. Doesn't this look so good? I am going to let it rest for just a couple of minutes. We'll cut it into six equal servings, put it into the meal prep container and I'll give you guys points and calories. And here is lunch quick and easy. Most days I have seven of the mashed potato cubes. One day I have six, I was one short. You guys have one to make it an even seven per day, but let's go over points and calories. I can't tell you how excited I am for this meatloaf. It is so moist and tender when I pulled it out of the pan. It looks so good and cheesy from the feta. I'm stoked. So the meatloaf itself makes six servings. It is three smart points per serving on both the blue and purple plan and then four points on the green plan just because you do have to count for the 99% ground turkey, even though it's really, really low points. And it is 138 calories per serving, that's it. So that is fantastic for lots of good protein. And then if you have six of the Trader Joe's mashed potatoes, it is only two points. The days that I have seven, it is three points. And of course, green beans are zero. So this is lunch, you guys. And with the six potatoes, it's only five points. And with the seven potatoes, it's only six. That is not bad for a complete, healthy whole food lunch. So I can't wait to dig in. For a sweet treat, I am making healthy eggless edible cookie dough. Who doesn't love cookie dough? I mean, seriously. So we are using five ingredients. It's a very simple recipe. You can simply change up the chips that you're using. I'm going to give you some suggestions at the end of some different chips you can put in and using the same base recipe. So let me show you what is in our cookie dough. First, you're going to need some peanut butter. I have this crunchy peanut butter. I'm gonna use this. You could use almond butter, cashew butter, creamy peanut butter, whatever your preference is. This is what I have on hand. So I'm gonna go ahead and use this. This brand is only peanuts and salt, no added oil. You're also going to need a can of garbanzo beans. I know it sounds weird, but hang in with me. Stay with me. And then we're going to need some syrup or agave, vanilla extract, and then chocolate chips.  I'm gonna go with the standard Lily's dark chocolate baking chip. So let's make cookie dough. So to make our cookie dough, I'm gonna use my blender. You can also use a food processor, whatever your preference is. I have one can of garbanzo beans drained and rinsed. So you wanna add those. I know it seems like a weird ingredient, but I promise this should be really, really delicious. We're also going to add two tablespoons of maple syrup. And again, you can use agave if you don't have maple syrup. I have four servings or 56 grams of Lily's chocolate chips. Okay, real life. We should not have put the chocolate chips in until after we blend it. So, pro tip. Do not add your chocolate chips until you blend. Mine are just going to be crushed up in there. So keep that in mind. Oh, I can't believe I did that. Gosh darn it. And I don't have another can of garbanzo beans. But on my website, I will put the right way to do the recipe. It'll still be delicious. And then I have a half of a cup of the peanut butter. And you could use PB2 if you wanna try to lower the points, but I'm just gonna go ahead and use regular peanut butter and then one teaspoon of vanilla. And then we're just going to blend this up. Now remember, you would not put the chocolate chips in like me. You would reserve those and put them in once it is all blended. So here is what the cookie dough looks like. I ended up having to add a little bit of almond milk. And I think it's because I added the chocolate chips. There are still chunks of chocolate in there. So I am not gonna complain. But let's get this into a bowl so you can see what the finished product looks like. And remember, yours will have big chocolate chips in it instead. And here is the edible cookie dough. You guys this actually looks really good and it made a ton of it. So I'm gonna share with you some other chip suggestions if you wanna make different flavors of the edible cookie dough but let's go over the points as is with the Lily's dark chocolate chips. And again, you can use PB2 if you wanna lower the points but as it stands, eight servings. So that's quite a big serving. Eight servings is five smart points on blue and purple and six points on the green plan, 183 calories. And I will tell you, I tried this. You do not taste the beans at all. You taste the chocolate chips, the sweetness of the honey. It's really good. It tastes like chocolate chip cookie dough. So that is the points and calories for this blend and let me pull out some extra chips and give you some variations. So some other variations are the white chocolate chips from Lily's which I'm out of but that would be really, really good in there like a white chocolate chip cookie dough. These butterscotch baking chips would be amazing. Chocolate mint would be really good. And then these I recently picked up in my grocery haul on Saturday. You guys, these chips are so good. These milk chocolate baked believe. These taste like real chocolate chips. There's no stevia taste. You know how Lily's are good but they have that little bit of stevia taste. These have nothing, these are incredible. So I highly recommend these if you can get your hands on those but those would be just some fun variations on the cookie dough but yum. Who doesn't love cookie dough? Thank you for joining me on this week's meal prep. Aren't these three recipes to die for? Hello cookie dough, yes please. I cannot wait to dig into breakfast, lunch and of course the cookie dough all week long. Again, these recipes are on my website which is in the description box along with my nutrition coaching website. I'd love to help you on your healthy lifestyle journey. So definitely check that out. Discount codes, links to my favorite things including some of the items I shared with you today and the link to head over and join my public Facebook group Jen's WW tribe, we'd love to have you over there as well. So again, if you're new, I'd love it if you'd stick around, hit the little subscribe button and the bell next to it so you're notified whenever new videos are uploaded. Like I mentioned, I meal prep every Monday so you don't wanna miss out. Again, thumbs up this video if you enjoyed it. Thank you guys so much for hanging out with me on this beautiful Monday and I'll see you all in my next video. Bye friends.