Hi. So, for those of you that didn't catch that, my name is Luke Young, and I'm here to talk about Achieving Reliable DNS Rebinding in Modern Browsers. Thank you everyone who made it out here, woke up early and got your badge. Really appreciate it. All right, so, my name's Luke. Like I said, I'm a senior information security engineer at LinkedIn. I've been there for about a year now since I started full-time. I've interned at a couple different security teams at a few other companies. I see some familiar faces out in the crowd. That's my email address, both work and personal, linked to my LinkedIn profile. All of that will be up at the end if you have any questions. Just shoot me a message. And as mentioned, this is my third year at DEF CON. So, I gave a talk last year on the subject of attacking network infrastructure to generate a four-terabit a second DDoS for five bucks. And the year before that, I gave a talk about investigating the practicality and cost of abusing memory errors where I explored DNS bit flips. So, in case you don't see a bit of a theme there, I like networking stuff, specifically anything that has to do with DNS. So, when I heard a bit about DNS rebinding, I decided it was right up my alley. So, here's how we're going to talk about this today. We're going to establish a fictional company called ACME Corp. And we're going to use that for all of our references so that everyone can understand DNS rebinding. We're going to establish a network topology for this company. We're going to talk about how DNS rebinding could be leveraged in an attack against this company and then how to automate some of that using the tool that I built, which will be released at the end of the talk. And then finally, I'm going to talk about some of the practical exploits of DNS rebinding against some real tools and applications. All right. So, we have our ACME Corp. And we're going to start with an internal corporate network, which we're going to refer to as corp.acme.com. Of course, we need some employees. So, we're going to add a developer, Chris. Chris needs somewhere to commit all of that wonderful code that he writes to. So, we're going to add a code repository located at code.corp.acme.com. Of course, our developer, Chris, needs to get to the internet so we can look at cat pictures at work. So, we're going to connect the corp internet to the actual internet. And finally, we need our bad actor in this scenario. So, we're going to add our attacker who owns attacker domain. All right. So, a couple of quick notes about this architecture. First off, we're going to refer to this entire area on the right as the intranet, essentially the internal network of this fictional company. Next, we're going to assume that our attacker has insider knowledge of this network layout. So, whether your network engineer decided to post the entire network topology on his resume, on his personal website, or a disgruntled employee took some internal docs, I'll leave that entirely up to your imagination. And we'll get to why that's necessary in a little bit. For the sake of simplicity, we're going to assume that code.corp.acme.com has no authentication on it. So, Acme had a long meeting with their single employee and decided they trust their one employee and you have to be on the intranet in order to access this. So, they're not going to put authentication on it. Now, this is just an example. This code repository could be anything lacking authentication on your internal network. It could be a wiki page containing company secrets. It could be your internal HR system. It could be some marketing website for a new product that hasn't been announced yet. Who knows? It could be anything. And I don't think I need to ask people to raise their hand to about at least one of those things probably has existed on their network at some point in time. Everyone spins up something and goes, oh, it's fine. It's safe. It's only accessible on the intranet. Only our employees can access it. All right. Finally, the edge of our network, like I said, is going to act as a firewall preventing our bad actor from directly accessing code.corp.acme.com. So, the only way you can access that is again being on the internal network. And lastly, we're going to assume that our developer, Chris, just loves to click on links. Doesn't matter if it's a sketchy ad or a fishing email, Chris is going to click on that link. All right. So, before we get into how DNS rebinding works, I wanted to do a quick refresher on same origin policy and browsers, how they work. So, let's suppose that our developer, Chris, has browsed to attack our domain. Now, Chris has loaded our malicious website. It can start executing active content like JavaScript or Flash. Assuming he doesn't have any plug-in set up. But Chris likes to click all of the links. Doesn't like to install things like NoScript. And since Chris is on the internal network, he also has access to code.corp.acme.com in another tab. So, as you can see here, we have Hello World, their, you know, billion-dollar company plan from HelloWorld.CPP. All right. So, what if our attacker domain loads evil.js and evil.js makes a request to code.corp? Does the browser just let this through and we get a 200 okay? Of course not. This is blocked by the browser's same origin policy. So, same origin policy is exactly like it sounds. It checks if a request has originated from the same origin as the current, currently executing script. So, while a request to code.corp.acme will fail, our request to the same origin attacker domain would, would succeed. Of course, there are exemptions to same origin policy. You have cores or JSONP. But overall, same origin policy is actually pretty restrictive. You can't even do things like accessing a subdomain. That will get blocked by default same origin policy. So, but like I said, cores, JSONP, there are special exemptions to same origin policy but it requires opt in from the participating server. So, this is kind of same origin policy at the most basic level. This is what protects all of your information when you're browsing Facebook in one tab and your bank is open in another. All right. So, how does DNS rebinding play into all of this? DNS rebinding allows us to essentially trick the browser into making what it believes are same origin requests that actually reach different servers on the back end. So, let me get a little bit into how that works. So, let's imagine we have a browser run by our developer, Chris. We have our internal DNS server located at <IP_ADDRESS>, our attacker server which we located at <IP_ADDRESS>. And finally, our internal coder repository located at <IP_ADDRESS>. So, our developer, Chris, goes to his keyboard and types in rebind.attackerdomain and hits enter. Now, our browser takes a look at this and goes, I don't know what to do with this and so it asks our DNS resolver for help. It says, can you help me locate rebind.attackerdomain and sends an A query. That A query gets sent along. DNS resolver goes, I don't know about this and so it asks the DNS root. The DNS root comes back and says, hey, if you want to know about rebind.attackerdomain, you have to ask attacker domain. They have all the info about that. So, it forwards our question along to attacker domain who goes and faithfully returns a response that rebind.attacker domain is located at <IP_ADDRESS>. And we set a TTL of two. So, TTL basically says how long you're allowed to cache this record for. So, this gets sent back along through our DNS resolver all the way back to our browser. And our DNS resolver goes and saves that in its cache. Alright, our browser takes a look at IP and it generates a generic HTTP request. Note, this is an HTTP request, not HTTPS and we'll talk about that in a little bit. Our browser sends this. It gets sent along to our attacker controlled server and our attacker controlled server generates a response, sends it back to the browser and the browser renders it. So far, this is a completely normal flow. This is exactly how you would answer the infamous interview question, what happens when you type www.google.com and hit enter. So, this is where it gets a little messy. Let's imagine that our webpage that we just loaded wants to make a request to secrets.txt. Again, on rebind.attacker.domain. So, it sends this request. The browser goes, oh, I don't know what rebind.attacker. domain is and it asks our DNS server again. Our DNS server takes a look at that question and normally this is where the flow would end. The DNS server would say, hey, I have a cached response from last time. But if any of you have been timing, it's been more than two seconds since the last time we sent that response there and so our DNS resolver has completely forgotten where rebind.attacker.domain is located. So, it asks the DNS root again who gets told, ask attacker domain. This question gets relayed along to attacker domain and this time attacker domain sends back a different answer. So, we say rebind.attacker.domain is actually located at <IP_ADDRESS>. This gets sent back to the browser. The browser goes along its merry way and generates an HTTP request and sends it along to the IP it was given. That of code.corp. Code.corp sees a request and because it doesn't have authentication, sends the response back and now our browser has a copy of the billion dollar business plan but it's loaded on rebind.attacker.domain where our attacker can read that file and exfiltrate it. So, if we take a step back for a second here, let's look at what happened. Did we violate the DNS spec? No. This is a perfectly legitimate answer. Companies do switch around IPs all the time and companies do have extremely short TTLs all the time. So, for example, companies that commonly come under attack will fast fluctuate between short TTLs so that they can change servers quickly. Did we violate the HTTP spec? No. We sent a regular HTTP request. This is all perfectly valid. So, this right here is DNS rebinding at its simplest. Basically, we've tricked the browser into rebinding the DNS record as the page was loaded. All right. So, if we loop back to that ACME network diagram, what we've done is just let our bad actor actually utilize the access that Chris had on the network in order to access the code exfiltrate data from code.corp. If you want to think about this in another way, what we've essentially done is let our bad actor assume Chris's position on the network in the physical sense. An easy way to think about DNS rebinding is if our bad actor was physically in the room and plugged into the same network jack as Chris. This company was already vulnerable or at risk to having all of their code stolen if you walked into their office and plugged into a jack, we've just eliminated the need to be physically present to do so. The other reason that analogy actually holds up pretty well is because we weren't able to assume Chris's authentication for code.corp. Just as if I walked into your building and plugged into a network jack, I don't know what your developer's password is. And DNS rebinding works that same way. Because when the browser access rebinded attacker domain, it wasn't the same DNS entry that all the cookies were saved under, which was code.corp, they won't get sent. So, it's an unauthenticated request. So, that sounds a little bit scary. Let's talk about some of the gotchas about this attack. For any of it to happen, Chris had to visit a malicious web page. Then we required internal knowledge of the ACPY network. And we had to know the internal IP of code.corp.acpy.com ahead of time. So, for those of you that don't work with split DNS, basically the way it works, if you're on the corporate internet, you have certain results that will only resolve when you're inside of the network. And the way that works is your DNS resolver takes, when it gets a query, it looks at it and says, is this coming from inside? Okay, let me serve it these records over here. And, oh, this request came from the outside. Let me serve it those records over here. That's called split DNS. So, we can't go query code.corp.acpy.com from the outside to know its IP. We had to know that ahead of time. And finally, it was, the DNS rebinding is notoriously unreliable. So, let's break some of these down and talk about how to get past some of these. First, had to visit the web page. I don't really feel like I even need to talk about this. If you honestly believe that I can't convince a single one of your employees to click one link, you're lying to yourself. And that's literally all you have to do. You just have to click the link. You don't have to click on the page or interact with it in any way. You just had to open it up. Of course, there are other delivery mechanisms for something like this too. You could serve this in a drive-by malware or a drive-by malicious ad. You could of course send phishing emails, all of the traditional ways to get someone to click a single link. Yep. The next thing we needed to do was we needed internal knowledge of the target network. We had to know that code.corp.acpy.com existed. Now, I wish I could say that would be difficult to obtain that sort of information, but I wasn't joking when I said your network engineer probably put the entire diagram on his resume. I've seen that before. And you have people leaking host names all over the place. All of those GitHub issues that your developer posts and accidentally includes all the host names in the debug log, people like me are scraping those all the time. It doesn't matter if you had it up there for 60 seconds, someone pulled it down and we have that host name now. Plus, these host names are typically built for people, you know? They're not that hard to guess. Code.corp.acpy.com. Get.corp.acpy.com. SVN.corp.acpy.com. Wiki.corp.acpy.com. They're very predictable. So let's say we probably didn't actually need to know that. Of course, we had to know it lacked authentication. There's no real way to get around that requirement. We can just try it though. So if I was a malicious actor, I can try it, see if it works. If it works, great. It didn't need authentication. If it doesn't, move on to the next target. And we had to know that secrets.txt was located there. But I don't really think this one's a requirement either. Again, all of our web pages are built for people. I'll bet you if I went and hit the root of code.corp.acpy.com I would get a beautiful directory listing with all of the nice icons next to every file telling me where secrets.txt is. It's not difficult at all for a script to do that and do some real basic checks for anything with the word secret in it. Anything with the word password in it, etc. All right. Next, we had to know the internal IP of code.corp.acpy.com. And unfortunately, people don't really leak internal IPs nearly as often as they leak host names. Thankfully, at least in some configurations, we can just use that host name. So DNS has this wonderful feature called CNAME records. They basically act very similar to a sim link on Linux. When your DNS client reaches a CNAME record, it just starts over the process with the value you gave it. So when I asked for a rebind out attacker domain, if I serve a CNAME for code.corp, my DNS resolver will get, say, oh, where do we go? Oh, let me go look up code.corp instead. And we've just now bypassed that requirement. And what's really, really interesting about this, we let the internal DNS resolver do all of this work for us. So even though that record isn't accessible externally, your DNS client that's looking up this record is coming from internal. So I can CNAME to internal DNS records that don't exist from the outside and they will faithfully resolve on the inside. Now, in theory, you could block some of this on your DNS name server. You could never let external DNS records resolve to an internal IP address. Unfortunately, as far as I'm aware, no DNS resolver with split DNS functionality supports this sort of setup. If anybody is aware of any that do, by all means, please let me know. I'd be more than happy to take a look at the implementation. All right. And the next problem. DNS rebindings notorious unreliability. So if you do manage to find some of the folks that have heard of DNS rebinding, one of the first things they say is, that doesn't work anymore. It's so unreliable. It's not practical in the real world. Unfortunately, this unreliability and kind of the stigma around it from everything is commonly used as an excuse to avoid fixing vulnerable services. Everything from small applications to popular libraries like one of the Ruby on Rails web console scripts has this issue and commonly developers will decide not to fix it because of concerns that it's not a real world attack. So let's talk about where some of that unreliability comes from. There's a lot of ways that this can go wrong. You have a lot of layers here, both in DNS and TCP and in the HTTP level. So first thing you've got is browser DNS caches. So some people don't even know this is a thing. Some browsers, Chrome for example, depending on your system configuration, implement their own entire DNS client. They don't use the OS one or they build on top of the OS one. And so internally to the browser, they actually have DNS records that are cached. So if you take a look, Chrome colon slash net internals is a wonderful tool if you're ever debugging any network issues in Chrome. It will actually tell you all of the DNS records that it has cached, how long they're going to live for, when they expire, you can view them in flight, actually, as they go across the wire. But things like this can interfere with a successful DNS rebinding attack. For example, if in certain configurations Chrome will cache all records for 60 seconds, even though the TTL is set shorter than that, which means I don't have to keep my developer, Chris, on the page for 60 seconds. And Chris has a really short attention span. So that's not going to work very well. And we have the same issue at the OS level. So lots of OSes now actually do DNS caching internally as well. So Chrome will actually, again in certain configurations, build on top of the OS cache as well. So you now have two layers of caching where your record can get mangled, get modified in some ways. And that can cause more problems. You have name server, DNS caches. So for example, that internal DNS resolver probably caches that record for some time. That also means if I'm executing an attack against Chris and Chris' fictional second employee at the same time, both of those records can get confused in the DNS resolver because one of them is cached. So we'll talk about how we kind of get around some of that later. Browsers. So browsers have some protections here as well. Some of them will pin DNS records. So basically what that means is when you get a DNS query and an answer, it will save that tuple together. So you have the host that it looked up and the IP address it resolved to. And they won't let that resolve to a different IP on the same page. If you open up a new tab, it'll go make a new query, but that way you can't rebind on the same page. Some of them have done stuff like blacklist really dangerous ports. I'm pretty sure it's actually the same list between all the browsers for the most part of common ports that have had issues as a result of DNS rebinding or even other just generic XHR things. So for example, the SMTP port or I believe SSH is in there as well. You basically cannot make requests to those ports when it's on internal RFC 1918 IPs. And then some of them have some failed attempts at detecting DNS rebinding and trying to avoid it. So they try to look and see are DNS records changing in between responses. I have yet to see one of those actually really work super well. So give that. You have network protections. So this is kind of interesting. You can actually try to fix some of this at your DNS resolver. So DNS mask on the top has some settings that you can turn on to basically try to prevent DNS rebinding attacks. And open DNS has a similar commercial actually it might be free if you already have an account with them that you can turn on and it will try to prevent some of these attacks. Now the really important part with all these network protections is they only work if you can figure them correctly. And nobody does. So lots of people will block for example local host. I can't set a DNS record that resolves to 127001. But I can set it to resolve to <IP_ADDRESS> which is your IP address on the network still. So if you do use things like this and these are not a solution for everyone and they will not fix the problem overall, you have to make sure you can figure them correctly. And then finally just the general hackiness of this sort of approach. So we'll touch on that again in a minute. Okay. So this is DNS rebinding. Why isn't this fixed yet? This has been around, this has been a known issue. Like you said, this is an old attack. This has been here forever. Why isn't this fixed? Arguably it's not the browser's fault. And it's not that easy to fix either. There are legitimate use cases for all of this functionality. For example, if any of you guys use Plex, the media server, Plex will commonly trigger DNS rebinding warnings because of the way that they do their local network configuration. I believe Spotify as well will actually do if you use any of their web client, they have this feature where you can go to browse music on their site and click play and it opens up in the browser. The way some of that works is do basically a DNS rebinding attack and it will trigger some of these issues. So you will break legitimate functionality if you try to fix this. So there are open bugs against a lot of the browser vendors. It's basically asking them to fix these and most of them have come out and said we're not going to fix this. So Firefox's response was I'd also recommend that Firefox not fix this issue. It's not feasible for the browser to protect the user from DNS rebinding attacks. Servers need to protect themselves by validating the host header and firewalls need to protect themselves by preventing external names from resolving to internal IP addresses. Okay. So and we're going to talk about those protections in a minute and we're going to show a demo. But there are some things they can fix. So for example, there's this wonderful feature called HTTP 0.9. So for those of you that aren't aware, HTTP 0.9 is a very lenient parsing of HTTP. So the way that works is if I have a, I send a request and the server doesn't answer back with a full HTTP 200 okay, we still let the request go through and we continue talking to that server. This can be really, really problematic because you have things like for example, Memcached or Redis that speak line protocols that you can actually attack using this thing. So you send a request to Memcached. Memcached says I don't know what this is. I don't know what this is.  I don't know because it's a line protocol for every line of your HTTP request until you reach a command and you can then send commands to these and it never answers back with a valid HTTP request. So this is here because of legacy reasons. This was a lot more common back when basically servers weren't configured right. You had a lot of legitimate use cases for this. There aren't really any today and most of the browser vendors have decided or are working on getting rid of this functionality.  So here are two examples of that both in Safari and Chrome. So this is what I would ask that the browser vendors do. Turn off HTTP 0.9. After that it's on each of the applications to fix this issue. All right. That general hackiness. Let's talk about how we're going to fix this. This is a weird attack. It wasn't designed to be abused in this way and so it just doesn't work sometimes. So like any true engineer I decided the best way to fix this was brute force. So basically what we're going to do here is try a whole bunch of DNS rebinds at the same time. And we multiplex that out across a couple different iframes and we take whatever one succeeds and save that. And then we use that again next time. We know that this technique works against this user. At this point in time we're going to try that attack first. A couple other things we wanted to do. So I took a look at some of the existing tooling that's there for DNS rebinds. And some of it's great. There's a couple different ways you can do DNS rebinds and the tools in support all of these ways. They didn't have some features like IPv6 DNS rebinding. Basically I could not find a tool that that works correctly in. I wanted to have that sort of intelligent method selection. So certain methods work better in certain browsers. I wanted to be able to have the server try to target this DNS rebinding method versus that one for a certain browser. And then finally I wanted the ability to have dynamic payloads. So some of these tools the way they work you write up an HTML page and put it in with the tool and you have to serve that tool and get it running on the network. And you can only serve that one payload or you have to go and restart the server every time you change the payload. That's not very efficient. We want to do that better. And then finally some of these tools do some really interesting stuff with the TCP stack. So either listening on all ports or attempting to listen on all ports. I saw one that I don't actually think worked. I was using libpcap to try to detect when a request came in and spin up a listener first before it actually handled it. We want to avoid all of that. We want to do basically on the fly IP and port allocation.  The server goes okay give me a second, grabs an IP, grabs a port and triggers that. So let's talk about quickly about what the different types of rebinds that this tool supports. So TTL rebind this is kind of the simplest rebind. This is the one I showed you guys earlier. So basically you rely on the TTL expiring for that record. So you send one answer and then immediately flip any time you get asked about that question again you send a different answer. And then you exponentially back off on those TTLs to handle weird edge cases with caches. So this is what that looks like when you're actually triggering an attack. So those are flipped around. There should be the other way. So the first time, no actually that's correct. Sorry. So the first time you get a question you respond with the server's IP and a TTL of say two seconds. The second time you get a question you respond with the internal IP address that you're targeting. All right. Pretty simple. Threshold rebind. This relies on basically the second DNS request. So you say after I receive this threshold of questions, change my answer. So the reason this happens is you get really weird configurations for some of these caches. Some of them will send the same question like three or four times. Even though there was only one question internally that triggered it. So things like the TTL rebinds can get really messy there. So basically what this says is I got one request. I got two requests. I got three requests. Okay. Change my answer. And so you do the same sort of thing. You send, you set up one of these with a couple different back offs there in terms of timing. All right. Multi record rebind. So this one is super interesting. This one is, was I believe most publicly talked about, I think at DEF CON 18. And the way it works is very interesting. It's nearly instant in most configurations, but it's really expensive to, to host on the other side. So the reason that, that it's expensive is this. So I get a question for my DNS rebinding record and I respond back with two records. I say rebind.attacker domain is located at 203 and at 192.168. And some browsers basically if, if you're following the POSIX spec and everything correctly, you should try both of these IPs. Not all browsers do, some of them do, especially if they've been like Chrome will try to do this if it's, because it has its own custom DNS stack. So the way this works is the page loads, the first time you get a query to 203, you serve up your payload. And then on your server, you blacklist the IP address here. Literally set up an IP tables rule to block any new requests coming from this client over here at Acme Corp. Then when I go to make an XHR request, it goes, it tries to make an HTTP request to 203, it fails because it's blocked in IP tables. It can never complete the TCP handshake so it falls due to the second record. This one is super interesting as well because it defeats a lot of the protections in place by some of the browsers or some of the other DNS rebinding tools or detection. Because it's only one answer and it's just two records. There are legitimate reasons to serve round robin DNS like that. Lots of companies do. One of the problems with this though is the spec, I don't actually know what the spec says about this but lots of ISPs will actually rotate those answers. So you can't guarantee that they're going to show up in the right order. And the only way that this attack works is if your attacker server is served as the first request. So yeah. And the other reason it's really expensive to host is you have to cycle IPs very quickly. So if I blacklist the IP of you at Acme Corp and I'm trying to target another employee at the same time, they won't even be able to get the page to load because it's already blocked by their IP address. So what you have to do is you have to maintain a pool of IPs and basically dynamically allocate them out and say, oh, I'm targeting two people at the same company here, we have to give them different external IPs.  All right. So this is the usage of Janus, or not a Janus, of Jacket. So this, it's simple. This was the idea was make it as simple as possible and hide all of that. Do all of that for you in the background and you don't have to worry about it. Basically include the rebinding JavaScript and then use a standard JavaScript fetch and it's magically done for you on the back end. So hopefully, demo question mark, we'll be able to see this live. So let me a second. So we've got, up on the top, I have a server which I now have the tool running on. So the tool is written in Golang. It's up on GitHub right now. I'll have the link at the end. And it's pretty easy to use. Basically you provided a couple tools. You say what is the base URI that I'm going to serve from? So in this case v1.rebind.attack or domain. And then you serve, let's see. Okay. So you pass it a pool of IPs that it's going to be able to use. So in this case we have some IPv6 IP addresses. We have some IPv4 IP addresses. And I wanted to show this is one of the features of the tool as well. This is an internal IP. So this is a digital ocean box. And they have this thing called anchor IPs that basically it's an external IP but it comes to your box as an internal IP address when you look at it. So that's a configuration that's kind of interesting. The tool is built to handle some of this. So basically you can provide a mapping and say this internal IP is actually this external IP and it will serve the correct DNS records. So that means you could actually, if you really wanted to, you could put like this tool behind a load balancer or something. If you for some reason needed to do that many DNS rebinds. All right. This is the problem with live demos. All right. So here we go. Hopefully. So what I've got here on my attacker server, oops, we've already got it triggering in the other tab. So what I've got here in the bottom left tab is a basic Python HTTP server. And right now it's listing to the world serving up the entire file system. This is a brand new VPS. So not actually anything on there. Please don't go try to pull SSH keys or anything off it. You'll waste your time. So hopefully I'm having network issues this morning. So. All right. So you can see what it's doing here on the left. Apparently we don't have an Etsy password. So someone has already gotten to this box. Um. But we can see there that is the 404 page from Python there on the right. So it did actually trigger a rebind and request the file even though that file doesn't seem to exist. So if we take a look at actually in the network tab here you can see kind of how the attack works. Loads up the JavaScript. It starts a web socket with the back end where we send some information.  And so you can see some of these hopefully uh are red. So these are the ones that failed to load cause they directly rebinded. So you can see it's trying the multiple attempts. It starts pinging. We see success here. Once it finally hit a successful one, deletes all of the frames and makes our request to Etsy password. Which of course resulted in our 404. And so what that looks like here on the back end. This is running in extremely verbose mode. But you see it goes. It finds IPs meeting certain criteria. So for example if there were multiple people I was targeting here. Like I said it would balance between IPs. It'll go create HTTP servers on the fly. It leases the IPs basically. Um and then it goes and serves all of that. Alright. I'm running low on time so we'll hopefully. So how do you fix this issue? Here's the suggested mitigations. First off add strong authentication to your services. You should be doing this already. Anything that is vulnerable to DNS rebinding for the most part. You already have risk there of someone internal to your company taking that data. You should put strong authentication on everything. Even if it's internal. There are cases where that's not possible. For example local tools that are bound to loop back. Uh one of the ways that you can do some of that is verifying the host header instead. So you take a look at what the host request is. So for a legitimate request that host header will be 1-2-7-0-0-1. In the case of a rebind it'll be rebind dot attack or domain. So you should whitelist. Here is the expected host that this machine will ever be served on. For example wiki dot code dot or wiki dot corp dot acme dot com. That's the only address that should ever be accessed as you should whitelist that. So um I'll have a link at the end. We have a blog post up on the LinkedIn engineering blog with a link to the tool and some of this. We actually linked to uh how Kubernetes fixed this issue with their local tool. They basically did this. It's a really good implementation verifying the host header. They just check against a couple reg X's. Make sure you anchor the reg X though or else it doesn't work. And then finally adding TLS can be in a way to fix this as well. The reason is if you have your HTTPS cert it's only valid for wiki dot corp dot acme dot com. If you have a rebind that host name doesn't match and so the the rebind will fail. However you're relying on your developer not to just click okay on the cert mismatch. So not the best fix. Alright. So super excited to announce that this tool is live right now on the LinkedIn GitHub. Uh you can go check it out. Uh it's released under BSD 2 clause. Um and it's all go lang more than happy to uh accept some some inputs on it uh or file any issues. What is the future of the tool? Uh bug fixes. Lots of bug fixes. Uh if you have it and it doesn't work under certain configurations please open an issue. I'd be more than happy to take a look at it. I'd love to dockerize it or something similar so that you can literally just drop this on a VM and get it running. Uh and and then what I would really love to see is automated browser testing. I like to set up sort of a browser stack type setup where you can see oh they changed the DNS handling on Windows 10 for this version of Firefox uh and get alerts for a site or sort of that so that we can improve the tool. Alright. So like I promised here's all of my information. Um I will have the slides up on my blog. The uh blog post is actually I'm not sure it's up on the security blog yet but it's on the engineering blog that has a link to all of the mitigations in more depth along with uh all of the actual code or there's a direct link to the code. Thank you. Okay. A couple of announcements here. Um first of all uh we are not going to be dumping the rooms at least for now so people can hang out if you want to hang out for the next talk. But just kind of be polite. Last year we had some issues with people just kind of camping out all day. There's a lot of people getting here today. There's uh not a lot of stuff going on at the same time so be nice to other people. Kind of cycle through. Um yes yes. Oh and and this is more critical. If you're walking to that side don't. Exit out the back. Exit out the back. Exit out the back. Well look at that. That was fun. I feel like I'm playing a real time strategy game. Just draw the box. Through the back. Through the back. Okay. Second major announcement and this is going to apply in every track all weekend. Uh really the only danger to the con is the fire marshal.  If we do something like stand along the walls. See all those people back there along the walls? They're now sheepishly moving towards the seats. Yes those people are doing it wrong. Um so what we're going to have to do and this is a change from prior years where we kind of let you mill about and sits uh that as long as there was a path it was cool. This year it's not cool. So find a seat or you're going to have to leave the room. So that's going to mean we're all going to need to make friends. Sit together. Learn how to defragment the room. But we'll deal with that again here in a few minutes. Um let's give our first speaker another big round of applause. That was a heck of a job.


I worked in advertising and one of the most frequently asked questions we'd get was, how much money should I invest in outreach? Those were simpler times when communications with prospective consumers went mostly one way and channels to reach them were few. Beyond the capital investment a founder needs to make in order to market and advertise their company, entrepreneurs in the veteran and military connected community need to prioritize and develop a strategy to engage users through social media. Sherry Hofer, chief marketing officer and executive vice president of Wiley, a global leader in research and education and her outstanding team have put together a great presentation on marketing and how to make social media work for you. Sherry is a proud spouse of a Navy veteran and is showing her loyalty today through her attire on the Navy's birthday, happy birthday Navy. She's joined by Vakesh Dalal and Charlotte Tonkens. Wiley was founded 215 years ago and is focused on driving forward the knowledge economy through scientific research and career connected education. We're grateful to team Wiley for sharing their expertise with the veterans community. Welcome to DAV's caffeine connect, Sherry. Thank you very much, Dan. And as Dan said, my name is Sherry Hofer and I am the chief marketing officer at Wiley joined by my colleagues, Charlotte Tonkens and Vakesh Dalal. And we also have Eliza Horn and David Luckett, who is another former Navy veteran on the phone with us today who's helped us build the presentation. It is a true honor and privilege to be here with all of you today. And I wanted to make sure to thank you all for your service to our country. Your sacrifice does not go unnoticed. And when DAV reached out and asked us if we would be interested in joining, we really jumped at the chance. So as Dan mentioned, I am a Navy spouse. My husband retired in 2018 after 30 years in the Navy in the submarine force actually. And I'm also the daughter of a World War II veteran. So my shirt is not by accident helping the Navy celebrate. Dan mentioned we're a 215 year old publishing company. We have global operations in about 50 countries. We are family owned. We're still a public, we're also a publicly traded company. We're just over about $2 billion in revenue. And the way that we look at our marketing budget is we dedicated a certain percentage of revenue to towards our marketing. So we can talk a little bit about that later in the Q&A session if you have some questions. And our portfolio really represents multiple sectors. So we do scientific publishing, book publishing, education technology, as well as corporate training talent development. So we get a go from a direct to consumer type of environment to a business to business environment to a business to consumer environment. So we get a play in all of those. I've been in marketing for about 25 years prior that actually started my career in sales. And then I've been able to work in the various functions within marketing from product marketing to field marketing and marketing operations. So I've got a little bit of both and I would be remiss if I said I did not spend a fair amount of my career really building and testing a lot of failing and trying various ways to and various channels to engage customers and get them to really accept our calls to action. So for me, I believe marketing is a little bit of an art and a little bit of science. You really have to have that creative mind as well as that analytical mind to be successful in marketing today. So when it's done well, it can really drive growth for a business and can be a strategic revenue generating function. When done poorly, it can be the opposite. I am very customer obsessed. I actually grew up in a very small town in South Dakota and my parents own the local hardware store. So really understanding the customer and being very customer centric was really necessary for our survival. So and I knew and my parents very taught us very well if you can drive a great experience and you deliver for your customers, they will keep coming back. So we hope to show you some of that today. So let's talk a little bit about what we're going to go through today. We've got a few slides that we wanted to share. We'll focus on what is marketing and then we're going to really deepen dive into social media and how we believe that can help connect with your customer. We've got some tips on how to get started and we're going to talk a little bit about both paid and organic. We're not advocating for either of those, but we wanted to show you some of the value of each of those based on the type of businesses that you might be in. So if we move forward, if you think about marketing, so marketing has been in a constant state of evolution. So when you think about companies like Amazon or Google, these one clicks, the goalposts for marketers are constantly moving. As soon as we feel like we've got to know the customers and caught up with them, something else happens and we have to change how we're going to market to really, really capture that customer need and understand how we can provide value to them. For the most part, digital marketing has really opened a lot of doors for us, but it also has changed kind of those four Ps, those baseline of what is marketing. And how you use it to build business strategies. So we can go to the next slide. If you've ever taken a course in marketing or even a short class on Coursera, you probably heard of the four Ps of marketing. The original ones were really product. What are you offering? Price? How much are you charging? Place? Where are people going to find this? Where are they going to see it in promotion? How are you getting people to notice it? And these were foundations for any business strategy or for marketing strategy, but they've obviously evolved. And we kind of think of them as the four Ps reimagined. So we can go a little deeper into this. So if we move on to the next slide, we take really what we considered that first product and we've really moved that into what we call people. And it's really informed by people now. So when you're running and building a marketing strategy for your business, one of the key things that you have to do is really listen and apply what you learn from your customers to update your product or your service or how you're going to your market. These can be simple things like letters of recommendation from customers that you may post on a website or provide, or they can be things that you learn through human voice, you know, where you're either listening on social, you're having website feedback loops, you're having chats and customer service. Why do we do a couple different things depending on the product or offering that we have? We do site intercept surveys, you know, those little things that pop up and when you're shopping and ask you how you're doing, why you've left your cart, do you haven't purchased the things that you put in your cart? For example, in some of our more B2B offerings, we do quarterly customer check-ins, we do overall satisfaction surveys. If someone happens to call into our customer service line because they're having a problem, we then do a follow up afterwards, but we blog all of those calls to understand are we doing something that is disrupting that experience for the customer that we need to change. So that really helps us with our product to make sure that we're listening to that customer feedback to help us make the product even better. The next one is pressure, which was formerly kind of known as price. And price is influenced a lot by this pressure that is in the marketplace now from our competitors, from our customer experience. And what we always think about is cheaper is not always better. You have to be a bit careful there. We really try to define the value and really understand what we're offering to the customers. And this is where your experience can help you win in that pricing pressure game, because sometimes if you're paying less for something, but it only lasts half as long, then that's where customers can start to get angry about the experience that they had with you. For us, our place has somewhat evolved into our personalization. And this is where customers expect us to really contextualize that user experience for them. So it's done today on devices or on geography, your product interest or level of brand engagement. And this is really no different if you're selling products on Instagram, or if you're showing up to someone's house for a service. The experience and that personalization is a reflection of who you are and the time that you put into those customers and what you're offering. And an example for us would be, we live in a military community. And most of the businesses that we are around offer military discounts. And it's a way of personalization, it's a way of branding, it's a conversation starter, but it makes you feel more connected to that particular service. And then the last one is promotion, which we somewhat reimagined into purpose. And this is an interesting one, because customers typically choose brands whose values align with theirs. And discounts are great, not completely enough, because that mission of the organization and the social responsibility they play is big for marketers today. So if you're out building strategies and you're putting things forward, think about all the things that your company does and make sure that you articulate those inside of the purpose that you give people for your existence. And this is no different, again, from social into a B2B environment. It is all the same. It also is different, really, depending on who is the target audience for your products. So the younger your audience may skew, the more important that this becomes. So just keep that in mind, depending on what type of offering you have, or if you have a service that whoever you're trying to attract, that is going to become very relevant. So this is how we reimagine the four Ps, and we brought them to life. So if we think about social media, it's one way that can help you meet your customers where they are, and you can get to know them in a more personal way. And as you know, a lot of us spend a great deal of time on social media. So I'm going to turn things over to my colleague, Charlotte, who's going to walk you through a couple ways, depending on your organization, that you can think about organic social to help you capture those customers and those build out those reimagined four Ps to help you with your business and your marketing strategy. So Charlotte, over to you. Thanks very much, Sherry. So should we move on to the first slide? Thank you very much. So the term organic social refers to any social media action you haven't paid to promote. So it's your Instagram page, your LinkedIn page, your Facebook page and all those free posts that you publish from there. You might have heard how social is paid to play these days, and much of that is true in terms of reach. If you want your posts to be seen by thousands and thousands of potential customers, you're probably needing to pay. But you also want to build a good organic social presence so that when people check you out, they like what they see. And by this, I mean social pages that are at their most basic level, accurately reflecting your brand in terms of logos, descriptions, that URL link, the phone number and have a regular flow of content and someone checking the messages in case they require a response. A well looked after organic social page is an important tool to build followers, connect and engage with your community, promote your brand and establish trust and credibility. So let's move on to the next slide. So let's look at this through the lens of the classic sales funnel. The sales funnel is a great way of looking at the overall sales process. It shows how people move from becoming aware of your product or your company through to consideration to buy, think, converse then conversion. And after that, there are opportunities for them to become little customers and advocates for your brand by recommending your friends, usually their friends and their colleagues. So at that early awareness stage, organic social can contribute by putting your brand in front of potential customers who don't know your company at all, creating content that gets shared and pushes your company to a new audience. Paid is probably the best way to push out content at scale, but organic is a good place to start and to test what works before you boost it. Another tactic is to create ways for past customers to share their experiences with your company or products with their networks and in doing so, they promote you. As people move through the sales funnel and start to consider buying from you, this is where organic social can really come into its own and can help you build trust and credibility. While some people will buy from a random ad, others will check out your Facebook or your Insta to see if you're legit. 58% of people say they visit a brand's social properties before visiting the website. So in a way, your organic social pages are like your shopfront. You want your company's presence to be active, interesting, and present your brand in the best possible light. Social can help you stay top of mind and visible. Regular quality social posts build visibility by pushing your regular content out to your most engaged fans. Your content can show why your company matters. What is your cultural unique mission? How does what you do help your audience to solve their problems? Your presence is a good place to develop and share content, to tell your story, and maintain an ongoing conversation with the community. It's important to remember that social is a two-way conversation, or even more, you're not the only voice here. People can talk about your company and ask questions, even complain, and all of this is public. It might sound scary, but it's also an opportunity to connect and reply and be seen as an engaged and helpful member of the community. If you really want to stand out delivering a great social customer service experience is a powerful way to do this. Organic can usually be most powerful at the consideration stage in the funnel. It can warm people up so that when they see the ad from the page, social or the email, they're more likely to buy. Organic then comes back into play after purchase or conversion, so because you want to retain that customer build at all, community, and even inspire them to give you a word of mouth recommendation or promotion to their social groups. So let's just quickly move on to the next slide after this. Great. So five steps to start your organic social. How do you start? Well, you start by analyzing your current organic social presence. Does it look as good as it could be? Is there anything outdated or needs cleaning up? You want to make it easy for customers to find you on social, and if you're on multiple social media platforms, use the same account name on all of them to make it easy for people to find you anywhere. Link to your social media pages from your website. This way, your website visitors can check out your organic social media posts and interact with them. Are you active on all social channels where you have a presence? If not, close down the pages that are inactive. Dead social accounts can look worse than not being there at all, and there's always that risk if customers post comments or questions and you miss them, they think you're ignoring them. Take a good look at your posts. What works, what doesn't. Stop doing the stuff that has got no impact and refocus your efforts on what might work better. Get some ideas by looking at what your competitors are doing or other people in the same space. See what works for them. While at the same time thinking, how can you carve out your own unique space and differentiate? Think about your goals. What do you want to accomplish with a social media presence? List the primary objectives for how social will support your marketing goals. Don't overthink this, but setting your goals means that you can plan your measurements and you have a clearer idea what you want to measure. Then think like your customer. Who are they? What are their needs? How can you help solve them? What content are they already engaging with? It's important to have a sense of the kind of social platforms they're using. How do you find this out? Well, you could ask them. If your business is face to face, that's fairly straightforward. If not, you might want to send an email or a survey. Search the different social platforms with key keywords and conversations relevant to your company or location to see what content and conversations happening there. Look at the social platform user demographics data to match these to your customers. Once you identify the social platforms where they are, you can decide which platforms you want to point your efforts into. Then you want to plan your content. A content calendar is a great way to plan ahead. It gives you an overview of what you'll be posting, helping you to create a cohesive strategy and identify content gaps. Your content calendar can also help you with balancing your content every month so you're not overposting one type of content. When I say content calendar, I'm talking something as simple as an Excel spreadsheet. Think about how frequently you can post and try to stick to that. Social platforms favor regular consistent content rather than infrequent bursts. As a rule of thumb, two to three posts a week is a good place to start. Think about what content you have available that you could repurpose such as reviews, blog, video, are customers creating content around your company already? Is there a way to encourage more of this? Sharing user-generated content around your brand can be a good way to encourage or get authentic word of mouth recommendations for your business. Think about what other opportunities might come up for you on the day to day that could be turned into regular photos or videos. So use your calendar to plan ahead and stay relevant. Prepare for seasonal or holiday posts, for example. You might want to, on a Mother's Day, on Mother's Day weekend with a heartwarming Instagram web reel or image, or promote your Father's Day sale when the occasion comes around. Overall, keep your content around 80% informational, entertaining, or educational, and save those promotional posts to not more than 20%.  Most of us appreciate brands that share helpful posts. So when it's time to think of a solution to their problem or their needs, you'll remember that brand that educated you, made you smile, or made you laugh. And then thinking about engaging and connecting, one huge opportunity with organic social is the ability of office to have real conversations. Join groups, communities, and other conversations where your customers hang out. For example, if you're focusing on growing your business within the local neighborhood or region, then Facebook groups and other local spaces like this can be a really good opportunity. Use them to listen, build insights, and also join in where appropriate to be helpful and share ideas and solutions. Don't do any hard selling here, because that's just going to scare people away. But instead, use social communities to establish your credibility, your expertise, and build people's trust in your business or brand. You can also ask your audience questions and use polls as part of your own page content mix to trigger direct connections with your audience. And then finally, don't forget to measure and evaluate your organic social media post performance. The metrics will depend on what you're trying to achieve. But in general, they can fall into brand awareness, brand engagement, and content consumption. Brand awareness, that's likes, favorites, save shares. These are all indicators of whether your content is working or not. Content consumption, that's link clicks, video views, and be aware that many platforms count a video view at two seconds, which is actually pretty low. Look for quality metrics like 10 seconds watched. As you look at your best performing posts, you want to ask questions like, what topics were your audience interested in? What type of content did they consume more of? Which social media posts led to the most number of visitors to your website? By evaluating your organic social strategies monthly performance, you'll find out which topics resonate well. You'll also discover your customers' concerns, pain points, and attitudes towards your brand. And these insights can help you plan your next organic social media content calendar, and they let you know more about your customers. So that's about it for organic social. I think I've passed the baton now over to Vakesh for paid. Great. Thank you, Charlotte. What an amazing overview. So let me just give you guys a quick background and explanation on the paid social, paid social really is a way for businesses to get to three things. Gain speed to market, target the right type of customers. And then, as Sherry mentioned in the four Ps, it's also about staying top of mind and relevant in a really competitive environment. There's a amazing stat that I found around this exercise. It's about, you know, in 2021, North American businesses spent 48 billion dollars on paid social ads. So the space is super competitive. But it's not, you know, it's not unachievable. I see on my social feeds many, many new brands launching, sending me ads. Some of those, you know, to Charlotte's point earlier, some of those ads are really compelling. Some of them are like, I'm never going to click this. So those that do it really well grow fairly quickly. And that's where paid social can really help to unlock some of the learnings and how to do how to do this. So if we move to the next slide, I'll talk a little bit about the same in the same process as Charlotte, what are the five steps to launching your paid social platforms. So one organic social is important from what you've seen earlier, understanding the purpose of each platform and what your customers prefer on that platform is important. Learning how to refine your messaging and your content and getting the highest engagement with the metrics that Charlotte shared is also really important and continuing to build that following and knowing what's working through that repetitive exercise. From that, what we do is we generally take all of that organic social learning of what content, what our customers are and really start to build and create personas of what our core customers like. So if you look at an example of what are the topics that they like, you might start to personify the types of the core customers that you're after and try to understand what types of content and topics they're really interested in. We take that persona and we map out what the journey is across the sales funnel that we want that customer to have and we think through that in a content mechanism for paid social. So as an example, let's say we're going to focus on Instagram. Instagram has varying different formats of types of ads. You can do video, you can do photos, you can do reels, there's a whole number of different types of formats there. You really want to think about from the content engagement standpoint, what that ad and that paid social content is doing, what do we want the action that customer to take? When they click that action, what is the experience that they're going to get? Based on that experience, do I want them to become aware of a new product or a new service that I have to offer? Do I want them to promote the fact that I have a service or an offer to their network? Do I want them to actually make a purchase? All those kinds of things we map out very clearly in a journey map so that we understand when these ads will launch what the end goal and what the end journey for the customer is going to look like. We translate that map then into assets and copy and actions for each platform. We take the content calendar as an example and we lay out across the journey, here's the images we're going to use, here's the videos we're going to use, here's the copy that resonates really well against this video. That copy is just as important as the visual elements on social platforms being really, really laser focused around the action that we want that customer to take based on the next step in the journey is how we optimize our copy. So if I post a video about, let's say I'm a store on Main Street and I want folks to know that I'm opening next week, the copy will be focused around the fact that there's a new store opening, what the store is about and the date and we'll keep it short and sweet and simple as an example. The next part is really about defining what success will look like as a part of this total plan. So it's very difficult when starting paid social activity to try to do everything on every platform and try to do that really well. So what I always recommend is pick the platforms where you will start and fewer is better to really build the engagement and level of understanding per platform. It's really difficult to focus on videos on TikTok and photography on Instagram and Facebook posts that have multiple types of engagement levels and types of content and to do all of that really well becomes a daunting task until you've gotten the foundations really down and packed of understanding what your customers are actually interested in, what are they clicking, what are the topics that resonate and so on. So fewer is better when you're starting and it's really important to focus on the purpose of the platform and the relationship you want with your customer as a foundation for that. And then from a paid perspective, it's really important to define some goals. One of the KPIs we use is ROAS, it stands for Return on Ad Spend. So we really look at as a part of our paid social activity, what am I going to invest in the ads and what am I going to gain as a result of that. And that KPI of ROAS can exist at multiple layers of the actions that you want your customers to take and awareness ROAS will be very low because you're not going to see a direct attribution on raising that awareness unless you're measuring it based on how much traffic you get to your website. You can then maybe quantify what the traffic means for you on a website. But it's really important to have that clear understanding of this post is to raise awareness. I'm going to anticipate that it's going to return low ROAS, but it's important first step for me to get to the next stage where I'm going to introduce a product or service from my brand or from my company that will then hit a more targeted action, which will lead to a higher return on that ad spend. So in that if we take the 80-20 rule that Charlotte was messaging, was mentioning and organic on paid, it becomes very, very focused on the goal that we want to achieve, the target that we want to set. And that target would be different for every platform as an example. So for a video platform like TikTok or now Instagram is moving more and more heavier into video as well, the return on what that action will translate to in TikTok is very different than potentially putting a promotion or an offer on Facebook. And so we would set different goals and different targets between Facebook paid social ads and TikTok paid social ads. So it's important to make sure we understand and define that clearly as well. The fourth step is really around resourcing it. So once you've got steps one, two, and three started to crystallize, it's about putting an action plan in place. It's about pulling the team together who's going to work on this. It does not require a big team, but it does require focus and it does require constant monitoring. There are lots and lots of learnings to be gained every day that your ads are out there on the platforms and a good paid social media marketer is constantly optimizing and adjusting. These are not leave it and forget it types of ads. You're looking to see is the copy resonating is the content or the images or the video is the is the view through high is are they you know are the videos being watched for six seconds or 15 seconds. All of those things start to play into what the what this team will do and how they'll sort of optimize across all of your different ads. Secondly, it's about defining a budget that you're going to spend. I'm a big fan of testing before investing heavier and I always look at invest small, take some learnings, and then scale bigger and bigger as you know what's going to work and what's going to perform well. So as we enter new platforms, we sort of dip our toe with smaller budget investments to get key learnings out of our paid social platforms. If we went full-fledged on on TikTok as an example and we spent you know thousands of dollars or if not millions of dollars in that platform, we might walk away with a number of different learnings but they also came at a really really huge expense for us to be able to invest again. So at that scale it's very important to identify where do I want to start, what do I want to learn, what does a good learning look like based on the success metrics that I've defined for my advertising spend and the goals that I've set and then being able to have a and that's the last step is have a frequent check-in on that plan. That could be daily, that could be weekly, that could be monthly based on step three and how you've started to define what success looks like. And then finally, I hope what you're taking away from this is that this is an iterative process. We are constantly sort of ideating and optimizing, we're prioritizing where we're going to invest, taking our testings, analyzing the results of those tests and then feeding those into new ideas. It's very easy on these platforms to get lost in ensuring that you're doing everything right by the platform but when it comes to paid, I really want the platform to work for me. I'm not here to work for the platform so I really go and look after, does the platform give me the return that I need? Does it engage with the right type of audience? Does it give me the scale in the business and the business results that I'm after? And then continuously feeding that loop based on that, based on the learnings I gather from that platform. So I think that's it. That's the overall five-step paid social plan. There's a lot more in that. I look forward to questions if you have them. Hey, thank you so much, Harga. So this is a quick case study that we wanted to share with all of you on a friend of mine actually who started a business called Margo's Morsels. So small business and she started it during the pandemic. It's a business to consumer business and it really it started because oddly enough, her husband loves to bake bread and so there's only two of them at home and they would have the successive amount of bread left over. So she thought of, you know, why don't we figure out a way to take the spread and use it and sell it and make it into some tasty morsels and then this then it just started evolving into this huge business. So she launched it both in stores in retail, select retail stores as well as online. And here's what she learned is I mean almost immediately she found out that Instagram was the best channel for her and for that she was able to do but it also required like Vakesh and Charlotte indicated a lot of creativity and it required work and there was that balance of art and science and when she used Instagram, she had a couple things that occurred which is the data that she got back on the customers was amazing. The acquisition cost for her customers was extremely low because she didn't have to box up her loads of her product, take it to a retail store, have it put on shelves, have it be bought and not really know a lot about what those people who those people were and why they were buying the products that they were and her lifetime value was high. So once someone bought from her, she was able to constantly go back and remarket different things to them, recipes, you name it. So she just started expanding a lot of the business. So the retail side took work but the volume was better. The social side also took work and she needed to then figure out how to be creative and to really dedicate people to running that business. Again, she's a B2C business so it's a small company but she was able to figure out which channel she's now in the process of looking for like the cash it indicated a dedicated person to help her with her social side because she knows that she can expand the business more rapidly and the investment on it is lower even with bringing someone in to help her with that creative side and helping her kind of monitor those particular channels. And she did throw in, I told her we were doing this presentation today so if anyone's interested she did add a discount code in there, that's 15 if anyone wants to go and check them out on Instagram. They also have a presence on the website. She'd mentioned to us though that overall the Facebook piece has not worked well for them so they're really focusing their efforts on Instagram. So I think there's a couple key things we'll wrap up with before we go to Q&A but when you start to figure out what you're going to do for your budget or what you're going to do for your marketing strategy, remember that return on investment is very important. You got to have the agility to look at all the channels, figure out what your business does, which one of those channels is the best for you and focus in on those. We do that. Charlotte and both Vakesh talked about different tactics. We do sometimes what we call 10-10-80 where 10% goes to one channel 10% to another and double down on the 80% and that helps us like Vakesh mentioned understand where we should be spending our money. About 75-ish or so percent of our budget today goes to digital. Part of that is a result of the pandemic. I mean obviously during the pandemic everything that we did went digital. We had a lot of face-to-face events and presences that we used to do. We had to stop a lot of that and really figure out how to keep our customers happy but do it in a digital sense. We've maintained some of that and we've continued on the digital side but those four Ps that we talked about way at the beginning are very, very important for us to help us understand are we reaching our customers in the ways that they want to be reached and is it effective so that people, the pressure, the personalization, and the purpose have really become essential for us to make sure that we're spending our money in the right ways to drive our business forward. So with that Dan I will turn over back to you to see if there is any questions that anyone might have for us. Thank you so much Sherry. We actually do have a question already. I'll turn it over to Pete and Pete might not be aware but you did a rebranding for Wiley so this might be a good question for you. Go ahead Pete. Oh first off thank you so much for the excellent presentation everybody did a phenomenal job and the content was so me. I mean there was so much on each of those slides but I wanted to follow up since I'm very familiar with Wiley, a phenomenal company. I would love to hear how you use organic and paid social to promote your books. I mean it would love to see an example especially the idea of return on ad spend how that works to generate revenue and profitability for your company. Thank you so much. I think that sounds like a great one for Vakesh and I saw he's already off to you. Yeah I could take a stab at that. Good question Pete. So obviously for us as Wiley we do way more than books. Majority of our book sales have multiple different types of customers right. So if I were to take a very direct to consumer an e-commerce view a lot of that return on ad spend on social comes through students buying textbooks as an example for their back to school time seasons and we generally look for anywhere from at least a minimum of 2x to a 4x ROAS. So if I put a dollar in I get two dollars back out or if I put in a dollar in and I get four dollars back out it's like the the benchmarks that we set across that and that's achieved through multiple platforms. So it's you know it's it's it's really based on the we'll get very very tactical here but I'll try to keep it high level but it's really based on the discipline the student the geography all of those things start to weigh in on what our overall return on ad spend should be. I had a question maybe this is for Vakesh as well but you were talking about picking platforms and focusing on platforms from a from a customer service perspective do you do you have to be on all the platforms in some way or do you have any thoughts on that? Yeah you know customer service is an interesting one. I've worked at many retail brands in the past and I think the the best sort of example that we've seen is we activate customer service in social media channels where we already have a high level of engagement and conversation happening. So it becomes a national sort of a natural extension of the conversations customers want to have on that channel. So rather than forcing forcing it on the customer we wait until you know so as an example you might be gaining a lot of awareness and track and engagement on Instagram but majority of the chatting and conversations are happening on Facebook. So then with Facebook Messenger you could launch a customer service presence and keep your Instagram focused on building audiences. Do you have any advice on social listening? Yeah and I think Charlotte I'm going to turn that one over to Charlotte because I think she's gone through a far more experience on that social listening platform than I have. So yeah well there's an awful lot of social listening and we use a variety of tools. Probably I would say the social listening the first thing that you need to be listening for really is people talking about you and your brand. So at the basic level it can be a matter of plugging those keywords straight into the search tool of the platform that you're talking about or identifying and it's a following on from that once you've sort of started to go that route of searching the platform also start to identify a list of other keywords that might be really relevant to your brand there might be hashtags that you're associated with and so really the first goal of social listening is just to hear what people are saying about your brand and take insights from that then you might choose to widen it to other business critical topics that people might be talking about that might influence the success of your company. You might also want to check out what people are saying about competitors and others and key stakeholders in your business. So we also do an awful lot of proactive monitoring for understanding what our key customers are thinking about certain topics or themes within the industry and we get we can get pretty complicated but in terms of just where to start which is like where I think the original question was what are people saying about you what are people saying about your things that you really care about what are people saying about your competitors is probably the logical place to start and as I said those search bars in the social platforms they're pretty good if you want to get more sophisticated from there there are dedicated social listening tools available. I would just add one piece onto that Dan in Charlotte knows this all too well is that we probably spent the first I've been with Wiley for about five years and the first year or two we did not handle our social channels well we we let the chatter happen but we didn't engage it really social is about engaging and having a discussion and so we think it's a bad day when we find out things that people are saying about our company on social but it has been very it's very helpful for us unfortunately that's not what we want to happen but we do spend a lot of time trying to understand the sentiment of customers and measure that via social so we can understand if we're doing a good job or not so we now are very active and try to keep that dialogue going so that people can see that Wiley actually does have a real face and we are willing to respond and engage in discussions with people. Do you have any advice on how you do that because every every company has promoters and detractors do you have any advice on on engagement that that will be productive and or what do you do if you just if there's customers who are you know they're never going to be happy with what you're doing. Yeah I think our general rule of thumb for engaging is engage where we know that we can add value to the conversation and sometimes sometimes we can hopefully most of the times we can sometimes we can't and it's important to be aware particularly when it's a large company that once you do start to engage if you do join that conversation it's difficult to then just disappear and back out so be mindful that if people are just it depends on if you can't add value to the conversation if you can't solve the thing that they're complaining about on social media or at least reply with something that lays out concrete actions that can and will be taken that's when you probably need to consider whether you are going to enjoy during the conversation at all because your involvement in itself can cause a conversation to snowball. However if you can reply add value and directly answer the question that is being asked that can be very powerful in diffusing the situation. Yeah I mean I think to add to that there's you know especially when it comes to sort of those disgruntled customers doing it on social media I try to keep this I try to keep a perspective in mind that the reason that they're posting on social media is not just to talk to you but to make sure everybody's aware that they're talking to you so the response that you deliver there is not just for that customer but it's also for the rest of your audience on there so if it is a very you know disgruntled thing that they've posted on what I've always advised is direct them to the right channel to have that conversation immediately on social media so hey this is this would be a great top we're sorry you're having this issue we'd love to help you with this please contact us here or direct message us there or call you know or or email us here and that way the conversation shifts from a very public space to a private space. Great and forgive me because I might butcher your name here but Prasad you had a help me with your name please but you had sure how you invest in in social networking and paid. Sure yes thank you very much thank you guys for coming on here and providing this excellent presentation. Vikish you were mentioning something about the ROAS and sorry if I misunderstood or or just didn't catch you know everything you mentioned but I just wondered you mentioned something about you know two times and four times your return so I'm just wondering in saying to you know putting in two dollars and getting two dollars back you know what is is is there a benefit to that or did you mean that yet minimum two dollars back or more um you know help me clarify that for a bit for me thank you very much. Yeah absolutely so yeah what I meant to say is definitely um in in response to Pete question was what's our benchmark for the return on that spend and we look at essentially getting two x what we've invested back out as a business result or a business impact. So if we're not getting at least two x back so the the math is roughly if I put a dollar and I get two dollars back that would be the bare minimum of that. Does that answer your question or did you have a follow on? Yes no you that that helps great thank you very much appreciate it. Sure thank you both so much Harold Bowser I'll ask this on his behalf and this is a question I think that probably a lot of people have especially when you're starting a venture or when you're kind of you're you're just fresh to all this how many hours a week is a good amount to maintain all this media work excluding the amount of time required to build content? Okay so you're right it's sort of how long is a piece of strength but you know we've all got day jobs and other things to be getting on with right apart from me my job actually is social media um as a rule of thumb I would once you've built out your strategy and if we're not including the content creation itself um it really varies I would carve out around at least around 15 minutes a day at least just to make sure that the content gets posted to check the messages to check the listening to review um your most recent content is it working is it not get a sense of it so I would say about 15 minutes day and minimum depends on how many platforms you are so you know a bit of a finger in the air thing in addition I would recommend just on a monthly basis taking a good look at those analytics as we as we sort of covered in the previous session so a little bit of extra time on top for that but really it's it's a pretty open-ended thing but 15 minutes half an hour I would say don't try not to um let it take you down that rabbit hole which is all too easy thank you I think it's I think if I can add to that one um any more perspective for you Harold is is to keep it in perspective of the rest of the strategy around the business right so is it is it part of the is the social media thing so in Sherry's example with Margot's Marshall it became an all complete all all sort of you know a obsessive thing because the platform started to grow on its own for for that business and it required more attention and focus so and the red the net output of that was a huge benefit for her so that's the thing it starts to be successful you'll want to rest a lot more than 15 minutes but just to get yourself up and running you you're busy people you've got a lot of other things to be juggling as well great uh Prasad you had a follow-up question did yes thank you very much I actually have two um just wondered uh if you guys have any suggestions or recommendations on tools that you think might be the best to assist in these organic and paid social media processes and two are there any tips that you can provide to analyze the organic and paid data that comes back or that we can you know sift through in order to start our planning process on the types of content and the types of strategies that we actually would need to use moving forward once we get that data thank you okay I can quickly jump in on the organic side so what you want for organic is a tool that helps you schedule content ahead so you're not so you can have a bit of down time and get on with things um at Wiley we use a tool called Hootsuite it's one of the market leading social media management tools I think there is still a free version um the more you pay the more you get but I think there is still a free version of Hootsuite competitors include um other tools like Sprout Social as well but um yeah if you google social media management tool Hootsuite Sprout Social something like that um and then in terms of analyzing the data on the organic side as I said in the presentation it kind of connects on what you're trying to it links back to what you're ultimately using organic social media for um but once you've identified what you're the main metrics the main KPIs that you want to focus on so for example if you're using social to drive traffic um you you want to be looking at those that link click data in the social tool and or if you're wanting it to um build brand visibility and awareness you're wanting to see the kind of content consumption metrics what I've pre what I tend to do is um literally export the data and sort it into excel and uh look at the posts that come out top which are the ones that people are watching more of which are the posts that people are engaging more of and from that look at from looking at those top performing posts start to get some idea of themes or insights as to what do they have in common what what's going on here that's really the starting point for um looking at your data and and seeing what content is successful and what come what content isn't maybe there's a consistent theme maybe maybe there's a particular type of post for example in the um the case study that sherry sherry shared then might they they might have found that recipes did really well or they might have found that other types of content did really well so it's look at the data see what it tells you that is performing well look at um what have you got to add for paid no that's perfect I was going to say the same excel and google sheets is your is your best friend when I come say analyzing data chris how did you have a follow-up I answered both I think uh and that was actually great great feedback I'm you know looking at the data seeing the type of content consumption looking at you know what post people are actually engaging more with getting an idea of what they have in common you know is there a consistent theme which content did well I think those are I think that the challenge comes in I guess looking at all and trying to find the patterns in the content and I think that's what I gathered from your talk Claire is that correct I think so yeah excellent I have another I have a question this one's definitely for sherry not everyone is I mean some people on us if we're honest with ourselves you've probably scared them away from wanting to manage their own social networks and not everyone you know has especially with great English accents a team of people to do this do you have any advice on hiring selecting people maybe who fit your culture and it seems like a lot of people have social networking on resumes and it's it's not always that's not always indicative of the depth of experience or knowledge that they have do you have any advice on on finding team members yeah and that depends it's interesting that you ask that because our organic team and our paid team even though they're both on social are completely different right and so our organic team is is well that's Charlotte they're very thoughtful they're very they put a lot of content together they focus on they are both creative teams but they're going after different things right so I think you've got to really understand what your goal is so you can find the right person the pain team has a little bit more of a sales angle right like they're driven to make sure that they are putting up content that people are engaging with and they're achieving the ROI and they're they're kind of driven by that piece of it right so they they love moving things around they love taking like the cash and watching the dollars if something's not working they pull out and try a new tactic immediately because they're really driven by that so that's really what you have to look for is what's the goal of the organization and when I was talking to my friend Margot about this she was she's looking for someone she knows that she can double down on that channel so she's looking for somebody who's got a little more of a paid spin who is creative who will help her continue to build the business online she only needs about 20 hours a week but that's what she's looking for is somebody who's got a more of a sales angle that's a little more driven for her KPIs because she really wants to use it as a channel for her business so I hope that helps that we really look for a different type of person depending on which team that they're going to go on. Well thank you thank you all so much for your time I'm going to have to wrap things up right now I want to thank Wiley for sharing her expertise on the Navy's birthday to do something so patriotic and help all these entrepreneurs it's very appreciated. I want to thank everyone for tuning in happy birthday US Navy just to let everyone know we have a new Patriot Bootcamp event coming up next week at DEV National Headquarters we're going to have about 50 entrepreneurs here so we're thrilled about that and if you want to participate in future events please visit patriotbootcamp.org and sign up there to get notifications thank you so much Wiley thanks everyone happy birthday Navy and we'll see on the next DEV caffeine connect thank you all.