What's up YouTube hand waiting for Facebook to go live as well. What is up and welcome to insurance agent training live every single Monday? I don't care where I'm at. You know, we're gonna be live and right now. I am at the Palms in Las Vegas And I got confession, okay? I'm ashamed to say that we did not post insurance agent training live at 2 o'clock today Okay, which brings up a topic I I pre-recorded because I knew I was gonna be Vegas I pre-recorded the show and we did not post it Okay, so number one. I apologize because I've been doing this show consistently all Year insurance agent training and guess what I've been extremely consistent with it. What's up, Tony up until Right now. Okay, so it's so so so it brings up the question Does it matter if you are consistent in what you do and I bring up this topic because Most people that start stuff nowadays Most people that start stuff. They do not finish it Most of us get in a super bad habit of when we start something we say we're gonna do something We're a entrepreneur. We're a dreamer, right? We're saying that this is going to happen and then it doesn't Is that okay? Is that not okay? I don't think it's okay. Whether you're watching on Facebook or YouTube Using two phones my phone and Lauren's phone. I do not think it's okay. Okay, because when I say I'm going to do something I do my very best to make it a reality, right? I put all I put my my entire heart into everything I do and when I say I'm gonna do something I do it right so better late than never, okay? So I am shooting the show late interest agent training to talk about how you need to be consistent about how when you say You were going to do something you do it, right? I've been touring This venue all day today. I'm talking rooms. I'm talking to the theater Talking tons of restaurants ballrooms, it's an VIP party locations nightclubs all kind of stuff, right unbelievable place But and and maybe maybe I'm gonna get up at 3 a.m. Maybe I've been traveling a lot Maybe I maybe I should be tired and right. I'll do it next Monday. I'll put it off Most people would put it off, right?  I'm ready. I won't be working. Okay. I won't be working out. I'm gonna be pumping some freaking iron this year I am going to be my best, right? But maybe What's up, man? What's up? What's up Chad? What's up? But maybe They made a decision, but most people don't execute right this way That's what they talk about with with gyms the first January is just packed, you know, and then by May no one's in there Can you say the same about your business?  That's a great step when I say I'm gonna do something I like to tell the rest of the world because it puts pressure on me to actually deliver and do what I say that I'm going to do if you say you're gonna do something do it, okay?  I hold my team accountable if we say we're gonna do something Victor we freaking do it and if we don't It doesn't look bad on them, right? It looks bad on me same thing in your business when you say or do something you don't it looks bad on you But maybe you have a team and you delegate, right? But then something doesn't happen the people that are expecting you to do something don't think about them your teammates They think about you. Thank you Zach dude and do that's when You say you're gonna do something do it. I believe that Consistency is the number one reason why insurance agents fail Everyone has great weeks. Everyone will make calls today. Everyone. I want to put it's tomorrow Everyone will doorknock on Friday. Okay, everyone will grind and say I'm gonna make a six figures and make all these big claims and say all these huge things But then they do not do it They do not Show up and do what they say you're gonna do it They if you say you're gonna work out in the morning to kick off your day, right and to get yourself energized and pumped up Then do it if you say today I'm gonna do this this this this and this Then do it if you say you're gonna make six figures in 2019 a quarter of a million dollars in 2020 half a million bucks in 2021 then guess what it's on you to Do it and actually execute. That's where most people Speak things into existence. That's cool. Most people say they're gonna do stuff That's awesome. Most people have dreams and wants and desires and goals and targets It's one thing to have all those things. It's another thing to actually execute And it's my job as insurance training live every single Monday to come on and keep it real and to let you know that it's one thing to Talk about something It's another thing to actually be consistent with it and execute all Year long a lot of agents say hey Cody. I'm making calls on Monday night. I'm filling up my week I'm pounding the phones. I'm hitting it and I'm getting ready man. I'm telling you that they'll say this is gonna be the best week of my life and then it isn't Because it's easier to speak it than to actually do it Dude, I'm a little ended. I'm with you. It's easier to say this is going to happen Omar It's harder to actually execute, right? They always say the Take the load the road less traveled Everyone says they're going to be amazing Then no one actually does it people don't execute people are consistent. It's it's a decision Right. Well, the most people most people sort of make decisions, but they don't actually Believe in that decision enough to execute on that decision every single day. No matter what We got to execute. Okay, no matter what We got to be consistent if we say we're gonna do something we have to freakin do it If this message is challenging you right now, do me a favor not only give it a big old freaking heart Not only comment, but also share this thing out tag someone that needs to hear this message, right? There was a point in my life and I still do from time to time. There was a point in my life Well, I was in an all-time low. I was a big thinker a big dreamer, but I was not an executor This was this was a few this was a few years ago and it bothered me deep down and bothered me Linda I did I was a I was a I was a hypocrite man. I was okay, but what I've learned is It's everybody says stuff Everybody wants to do something right? Everybody wants to do something big, but no one wants to put in the freakin work and I learned a long time ago I say a long time ago several years ago that I told myself from now on when you say you're going to do something then do it Because most people don't People will respect you if you actually if you actually execute people will notice and you shouldn't people shouldn't notice That you're doing something that you said you were going to do people notice because other people don't Most people say they're gonna do something and they don't they say I'm gonna do this and then they don't execute Okay, so my challenge to you is be the one in Your family in your office in your industry in your area Yourself that actually execute be the one that actually execute and stays consistent year round It's not okay to just speak big words and think I think I'm going to make it happen. I believe in myself I'm amazing. I'm gonna do wonderful things. I'm gonna earn two hundred thousand dollars this year if you don't work who Freakin cares nobody cares if you're not consistent about it, and you don't actually execute Nothing else matters. So when When Tonight comes tomorrow comes and you say you're gonna do something, right? I'm ashamed that I told you I would shoot this every Monday at two and I didn't Guess what I'm doing it now because I won't about asleep if I don't okay because we talk about right We've been talking about it constantly if you say you're gonna do something you do it It's not okay to just speak words in action and then not actually be consistent and execute with it most people do Not Execute Victor that's a great question, right and and and you know what Victor says, how do you make your team? How do you make your team execute, right? You can't make your team do anything, okay? They need to believe in you. They need to know that you're Your energy is where it's out. How do you hold them accountable though phenomenal question, buddy? And I'm addressing it right now Your energy and your passion has to shine through when you're consistent They will be more likely to be consistent, right? I'm amazed that I'm amazed that we missed the two o'clock deadline today I think I don't know if the video was corrupted or something. We pre-recorded the show. We didn't post it. Nobody cares, right? It didn't happen.  I didn't do it and I should have and They know that I'm gonna hold them accountable Okay, because I'm passionate about what we do and every Monday at 2 o'clock We release a new show called insurance agent training every single week and when we don't Victor Okay to answer your question When we don't I express that I'm upset I express that I I expect this to never happen again and then also do You need people on your team that believe in you and they have your back if they say they're gonna do something They don't guess what they ain't serious. I don't believe I don't believe in keeping everybody, right? If your team doesn't execute express it to them and Then if they continue to not execute move on You cannot keep people forever. You want to but they don't execute If you tell them to do something and they don't do it, right? Then guess what they should believe in you enough as a leader and fill your passion your energy To get it done and do it and they should do what you say you're gonna do, right? Because my team is does great about doing what we say we're gonna do, okay? But in that you got a buddy But in this case, you know what Victor if you're if you can't get your team on the same page And they won't execute and they won't do something or the dude and they're not consistent Even though you tell them to then don't keep them and move on right somebody else will I've learned this a long time ago. Some will some won't so what who's next, right? If people on my team and you're especially on my team Victor, right? Did I just took them all to? Five-star hotel in Dallas. We throw a conference. We've got 80 million things going on, right? We are Helping in industry, right? We're passionate what we do our energy shines through right? I feel like working it on our team is like an amazing opportunity if they don't see that dude Someone else will okay, and the same can be said for your team. All right Dude if they don't answer my cut dude Victor says it don't even answer my calls If my team doesn't answer my my team answered my call 30 minutes ago, and I don't know it's like seven o'clock at home, okay? They get off work at 530. I called them at seven o'clock. I said hey, we didn't post a show today Well, apparently the file got corrupted. I pre-recorded the show. We didn't drop it. Okay, they answered the phone and that they now know That we're not allowed to miss the dropping the show I don't care if they got a good live on camera at two o'clock for interest in training live That's all that matters. Okay, and I'm being transparent today because hey what guess what? Most people everybody says are gonna do something most people to execute Victor. It's time to move on.  I believe in leading by example when I say that you got to be the hardest working dude in the building You got to be consistent. Everyone looks at you. Okay, you got an entire team. They're all going to look at you.  Okay. You're doing things for the right reason and and and you know what your team will fall in line Dude, if you're a leader People will do what they're supposed to do. Okay, and if they don't Time to move on Okay, and find someone that will so this message today is about about being consistent.   What's up man?  Word is you work keep it. Yep most people Speak things into existence and then don't actually do them people in my office are the same way man. What's up man? There's a lot of people in our industry that say they're gonna do stuff and then they don't that's a joke When you say you're going to do something Do it?  So that's my message to you guys today What's up, Patricia? Hope you hope you're doing awesome Patricia was the I love Patricia. She's a good choose a giveaway winner of our contest for 8% 2019 last year Hope you're doing well. It's all about being consistent. Everybody says you're gonna do stuff But most people do not execute and stay consistent That's what's a struggle in our business. You say Cody. I'm gonna put out I'm gonna make calls every week. I'm gonna do or knock every week I'm gonna run eight appointments every week. Okay, when I say I'm gonna run eight appointments When I say my run, I'm gonna sit with 10 people.  You know what? That brings up a story. I was in I was downtown downtown Springfield, Missouri one time and I Had not met my quota. So there's a couple of They're almost like government subsidized towers in downtown Springfield I remember what they're called and I went and started door knocking in those towers to sell final expense insurance Because I had not met my quota. Okay So when you have a Metro quota, just do whatever it takes Most people most people won't do it.  Nobody else would do what they're supposed to do either. Okay So so when that when the opportunity comes for you to actually execute and be consistent and do what you say you're gonna do Let's actually do it. Okay. Hope this message finds you. Well, hope you're having an awesome start to your week and a great Monday We're touring the Palms in Las Vegas today for a personation 2020. Maybe we'll have it here. Maybe we won't Okay, there's a concert theater here called the Pearl that seats of seats upwards of 2,500 people It's got 18 skybox suites. They had a 700 million dollar renovation on this hotel unbelievable spot unbelievable place. Okay What's up, Eric? I'm sitting up here Do an insurance trade you're training live because we pre-recorded it and guess what we didn't drop it. Okay And and and like I tell you guys I Don't want to be a hypocrite and say to do stuff and then not do it It's because at the end of the day Everybody else doesn't do stuff.   So let's just find you. Well, if you have a great week, okay?  Everybody says they're gonna do stuff The best speech yet, thank you Tom appreciate you buddy do hey We should have dropped it at 2 o'clock and we didn't manage your stage and training live is every Monday at 2 If I don't do it, I'm a hypocrite and a liar and that ain't me. I'm an implementer I'm an executor and when I say one do something I do it, okay? Do yourself a favor today That when you say you're gonna do something don't even say it unless you're committing to go an all-in and Doing it and staying consistent with it. Otherwise, it does not matter Be an executor be an implementer stay consistent when you say you're gonna do something do it Because that's all it matters Have a great Easter week appreciate you guys Thanks, you too. Make sure you guys subscribe appreciate you. Hope you have an awesome rest of your week Let's go. Hey go execute man. It's it's your just up to you. It's your choice do it for you. Don't do it


All right, so I want to talk about the software that we use to manage our customer base. Now this software is the remote access slash remote management tool that we use to handle all the updates, patches, checks, and everything in a very automated fashion. Now I've narrowed it down, blurred out some of the clients, and narrowed it down to a special use case that's set up for a computer in the office. Now, so this is like a drill down of the dashboard. We have a larger dashboard where we look at everything as groups. And one of the things we do is in the goal of automation, people ask, how do you handle lots of computers with a smaller stack? Well, we do so with a lot of automation technology. I've always looked at IT people a little bit different because it most people are going, oh no, automation may cost us a job and we're always like, how can we automate and make things easier and easier? This is one of those tools that we do this with. So every day, this is doing checks every 15 minutes actually. It's keeping an eye on the physical hard drive health for this hard drive. If there's any smart status failures, failed logins, making sure the managed antivirus is up to date. All the services are running for a different service check, monitoring protection, any policies, changes, all that. It also has series of tasks. I have a couple tasks set up for the, what they call risk intelligence. This is some more analysis that we can do so we can actually remotely do PCI scanning and data breach risk scanning. It keeps an eye on patches. And right now it has in what they call an outage that I said, okay, go ahead and update this. Just let me know that there was a vulnerability. The vulnerability was, and this was an old image and today is the 22nd. And you can see all these were installed. I purposely loaded the agent with the old image of Windows 7 and it does a vulnerability assessment. It says here's all the things to be updated. I went ahead and update and reboot it. It is just installed 271 updates for this. And then it also found that there was a Java runtime update. Now this is a basic Windows 7 machine. Like I said, it's an older image, but I wanted to give you an idea that it will go through and patch all the things it finds on there. Now the other thing it's doing is active discovery, automated tasks, dashboard controls, event driven tasks. It's going to log the hardware details. It will go through and this is some of those little details of different critical events that may have been found and let you drill down into any one of these. It also lets you get lists for assets. So we have the hardware. It tells me, and this is a virtual box. This is a virtual machine set up just for the demonstration here. It tells me generic non-PMP monitor. It gives me much better detail with the other computers. Matter of fact, with a lot of them, it gives me the serial numbers. And in the case of Dell's, I even get all the service tag numbers pulled in. So we have all the information we can look up warranties and all that with our client computers. It also gives me software drill downs. So it gives me software. And then if a client installs a new piece of software, I can also just like I did here. Instead of just sorting by the software name, I have it sorted by time and date. It helps us quickly find when someone installs a new application and needs help with it. So all that being said, this all gets loaded really simply on the computer with a single executable. So when we onboard a new client, we just take and pass what we call the agent. So we build an agent based on the customer profile. And it's one of the tools here. So we actually are going to, we download an agent or site installation package, they call it just for that client. And then it groups all those clients together under that category for us. We sometimes do this remotely when we onboard them. But that's what gets us in to the whole management side where we get to watch all the computers. Now, this is also managing all the antiviruses and they handle licenses for us. So the way the remote management software works for Matt, this is with Max remote management is what I really like is all the licenses, everything per workstation are handled internally for them, including their web protection. So the web protection websites, this went to categories of websites that it went to, and different actions, including just dumping these out to a list. So we can say, okay, what websites did this person go to? And we can do some analysis. It also because it's doing web filtering, it blocks a lot of the bad sites, and we can get restrictive. So we can create a policy on a per client basis. We have clients that say, I need a policy to really narrow this down and say, I only want these websites that they can open and lock everything down. We can do real restrictive policies on there. And we can generate reports based on those policies. So we can understand who's violating. I mean, they get a notice that if a website's blocked that, you know, they can contact us to unblock the website. Usually when they go to a website that was blocked, it was blocked for a reason. And they do not call us. And they know they shouldn't have been on that website. But we can do those type of management reports. So they, you know, can get an idea of where people have been wandering around to. Now, like I said, this is all on dashboard. This one's in yellow. This is another computer we have just for demo setup. I'm not going to get into that one right now. But it's got some errors because we just it's turned off. We actually get notices when these computers were turned on and off and, you know, anything else. The other side we can do is when we're doing this, it allows us to see inside the network. Each computer becomes an agent within that network. And it allows you to see the other connected history, activities, devices, which computers, and we only have one setup internally on this particular side of the network. But it tells you what these devices discovered. That includes like our HP printers that it found on our network. So it's kind of neat. It can find, you know, different. These ones are, I'm sorry, not printers. Those are more computers. It will find the printers eventually. I think we have one on this side of the network that it'll pop up. I only started scanning this a little while ago. But it kind of gives you the, you know, connected device, which ones it's seen, which ones are offline because it's seen before and then it didn't see them again. But it kind of gives us more insight. So when this is set up at a client, all the computers kind of work together to help build us a list of different devices on our network and keep mapping it for us. Now, the other things we do is with, we have the ability to take control of the routine viewer by clicking this and we can just grab remote access to that particular computer. So when people call us for problems, we know which computer we know the name of the computer, which we have a process by which we put the names on the front of all the computers.  Obviously, because it's internal, we just call this one Tom's PC. So this is the other nice feature that comes from that is when they see they're having a problem, we can run remote background on it, put my password in, and it's going to pull up the remote background council. This allows us to get to the back end processes and see services running on the computer and give us remote process control on the computer so I can actually start and stop services without actually having to log in. And I'll give you an example. I'm going to drag the window over here. This is the windows of a machine running an agent. So we'll see down here at the bottom, if they have this, they can click this to open up our website, the little help thing shows team you're running, it shows the web protection running and it shows the manage anti virus running. And let's pop open notepad. So here's notepad opened up on there. Now this is remotely I'm not connected remotely to this. I'm just using your remote background service. So we go through here, and we look for notepad, which is right there. We just and the process, are you sure? And it closes it. This is really handy when someone has some type of weird pop up or something like that, you just want to force them out of it. If they say, oh no, I got something and somehow they managed to get stuck in that without even logging in, you can just force close different things that are running in the background. And it does help. Now, the system does a great job of blocking all most all those websites that would have kind of crappy ads or pop up occasionally one gets through. And it's just really handy. I can go grab and just shut down chrome on without even taking remote access. And if there's a problem with the computer, we just had one the other day that had some strange problem after we loaded it that they had managed to get McAfee installed. I don't know how but it partially installed. And I don't know why someone tried to run it, but it was causing it to lock up and go in, you know, brought call some problems, we go to remote process control and boom, delete it, log in, fix it, no problem. It's kind of nice because it gives you that back end control and you can kind of immediately get something done. Now, for here, if you want to delete files or whatever, you have command line access to execute things. And you can just say, okay, there's a whole lot of temp files and we can say let's just delete all these temp files. And they're gone. You know, it's still got some subfolders, but you're going to get the idea that it gives us this easy back end access without actually having to take any remote access. And being able to do that gives you the ability to just fix a problem for a client one fast to not with disrupting the work, they can keep working, you just know that the printer spooler became stopped, I can just restart the printer spooler service, clear out the print spool, and away we go. Now that gets even more interesting for me if I want to do it as an automated task, I can run these automated tasks or we can add more automated tasks, which include different running process lists, service control option, SQL queries, if there's a server, I can just say clean up the log files on this computer because they're going to have a bunch of log or event or I want to defrag the hard drive next. And then I can say which drive, give it a name, force, and you get the idea, it'll let me set it up on a schedule. So we defrag it. Do I want it once per day, once per month on check failure, or just manually run it, mainly run it leaves it in here, and then I can just right click and run it at will. So this allows me to create more tasks for the machine to do or more checks. So overall the system makes our life very easy. Now any check I can run, I can also run on an entire site. So instead of just running it on this one computer, I can say I need all the computers to do this. This also gives me the ability to create an automated task, for example, because if I need to deploy software on a group of computers, or I want to load something, you can build a script and a queue to even pull a file from a website, download and run it on all the computers at once. So you can actually create the script, load the file where you need to, put it on there, and create an automated task at a certain time to load a file, for example, some, you know, maybe special software that that client needs. When once again, did it without connecting to their computers, makes life a lot easier. You can also just have it download the file and go into the back end and kick off and install it with whatever parameters you want per computer at your convenience. You know, this is just a really powerful tool that we have that helps us automate all the processes that go into managing customer computers. This also because it allows us in bulk to do it, allows us to save the money on both sides. We're not spending as much time managing it because the software manages and only kicks out the exceptions to us. If I want to know how all the hard drives are doing, I don't have to log in every computer and check the hard drive status. It's checking the hard drive status. It's checking the smart status. One of the nice things too, these asset reports for software and hardware are summarized for every client. So before I go in for a meeting with the client is going to tell me all their machines, what's on them. It'll create a nice summary and say you have this many computers at this processor speed, this money, have this many, this much memory. It'll even tell me how many mice they have installed on all the computers. The same thing when you have to deal with, hey, how many computers do we have AutoCAD installed on? Well, you can summarize all their software installs with the asset reports per site and I'll say, well, here's a list. Here's all the computers that also have this software installed. So our clients on this service, they get really good service from us because we can summarize everything for them. It helps manage all their inventory and it helps us manage all the data that we have. So I mean, once you get hundreds of computers on this, it becomes hard if you think about supporting hundreds of computers without a tool like this and being able to quickly have remote access to them. Now we do have the remote access, but we actually still prefer our ScreenConnect sessions. We do like TeamViewer that has it and they've just offered a new one called MSP Anywhere, which we're kind of exploring. It's a new feature they're offering with this. But we've just really happy with ScreenConnect because it does so many of the same things without having to be in this interface. We just really like the way ScreenConnect and the tool boxes are set up on it. We have a self-host version of that. So that's mostly how we do our remote support is through ScreenConnect. It's just a great program. I've done a review on it. You can find in my videos. But like I said, I just want to give an overview. I kind of joke this, how people, how we make the magic happen and showing just how these things run. It's also just a neat tool to be able to look at everything all the time and make sure all of our clients are running with confidence and managing all that. So that's my quick overview for the Max Remote. Just wanted to give kind of a, you know, this is something I never really got a lot of from some of the other vendors. They always want to just do a webinar with me and I wanted to show people this is what it looks like. I don't make any money recommending them, but I've been happy with the software and it's been working really well for me. So I just want to make a video and share it with some other technicians who have asked me the question, how do you like it? This is my reply. This is my video of how it works for us. And we've been using it now for a push in two years. The company's been through some changes, but I'm overall pretty happy with them. And in terms of functionality, it works quite well. So that's my review. If you like my content here, like and subscribe. Thanks.


Hi everybody, today is beautiful outside but not so beautiful for our aestheticias, so let me show you because we have a big problem with her. As you can see the leaves lost their color and they're pretty burnt here or here or here. And I am really sad about it because these were really big leaves and they were beautiful you guys and this could have been prevented. But you know what? This is a learning curve, it's part of a journey and now we're gonna try to fix it together. So let me tell you why this happened. If you've been watching this channel for a long time you know that this Trelitia has been here for about one year and a half or so and as you may know in the winter I used the grow light to make her grow. This was very beneficial for her because Trelitias love bright sunlight. So for example this leaf right here that now is damaged, it was a beautiful leaf and it actually came out after I put this Trelitia close to the grow light. And in the summer here in Berlin we have lots of bright lights so I thought that it would be a good idea to move this plant outside to our south facing balcony and this was a big mistake. As you may know south facing balconies or south facing window receive lots of sunlight and I thought that my plan would enjoy it because after one day outside it was already looking like this. This is because even though the Trelitia loves bright sunlight, this was too much sunlight and too quickly. And we just have to think about how the life of this Trelitia has been. So as you may know when we buy a Trelitia from the nursery shop these Trelitias have been grown in greenhouses. So already from the time that they're really small they're being protected from harsh sunlight because they're inside the greenhouse. On top of that I've had this plant as I said for a year and a half or so and during this time she was always indoors. This was the first time that I took her outdoors. So yes it was too much sunlight very quickly. So unfortunately I didn't know this when I placed her outside I saw that she was gonna enjoy the sunlight and after seeing the leaves in this condition I did my research and yes I discovered that I put her out too quickly and it was too much intense sunlight for her. So the first thing that I learned is that if we're gonna move our Trelitias from indoors to outdoors it has to be gradually. So when we place our Trelitia outdoors it should be covered by shade. Of course you should have her in a bright area just protect her from direct sunlight because this will happen to the leaves. And then if we see that she needs more sunlight little by little will increase the sunlight that she receives. Unfortunately I did not do that and that's why the leaves look like this. So I've done some research and there are ways to help our plant heal. So let me tell you what I found. If your Trelitia looks like mine and you have her at a spot with lots of sunlight the first thing that you want to do is to move her away from the sunlight. So you want to move her either to a shader area or back indoors. Now we want to keep her in a bright area because as you know the Trelitia does thrive in bright conditions. On top of that if your Trelitia looks like mine it has these brown spots here on the leaves that shows you that she's not gonna have so much chlorophyll in the leaves. And therefore she won't be able to absorb and convert sufficient light that she can use to grow. So we don't want to put her in a dark spot just make sure that she's out of direct sunlight. The next thing to do is to check for signs of dehydration. So for example if you see wilted leaves or that they are curving upwards this may be a sign of dehydration. What I would also do is to check the soil and if you see that the soil is really dry then your plant is thirsty. Now for the first couple of hours what I've read is that we don't want to soak the soil because if your plant is dehydrated this will shock the roots. But we do want to provide some water so what we want to do is to give her small amounts of water frequently during the first hours. That way we bring back the moisture to the soil and to the roots but at a slow pace. After we hydrate the soil we want to make sure that we keep the moist. So what I'm going to do is I'm going to check with my finger every couple of days just to make sure that the soil is still moist and once I'm feeling that the soil is drying out then I'm going to water. Remember you always want to check that the soil is drying out before you water because we don't want to over water Australia. So always check the soil to make sure that you keep the moist but not super wet. Now unfortunately the burn in the leaves cannot be fixed. So if you have a very damaged leaf such as this one here you can prune it. I have decided to prune the most damaged leaves which I can tell you is really sad because these leaves were really big and beautiful but what I'm telling myself is that this will open more space for new healthy grows. And I'm going to show you what's the best way to prune your strelitzia so she grows healthy and happy. So we're going to need very sharp pruning shears or a knife and what I strongly recommend is that you sterilize these either with alcohol or with hydrogen peroxide. This is going to help you prevent any pest infestation because maybe use them with another plant that has some eggs or anything so it's always good to sterilize our tools. And then let me show you how we're going to cut our plant. So I'm going to cut this one right here which is a very big one and is this one here. So we want to cut at the base of the branch and we don't want to cut like this. We actually want to cut in an angle like this. So I'm going to try it now with this one and then you can add some soil to the stem. This will actually protect the stem and also help it heal. And now we wait. What I'm going to do is to keep a very close eye on my strelitzia because as you can see one day under the sunlight and it was a very big damage. So yeah I'm going to keep an eye on it and I actually found a very good tip online. So what it says is that we take a picture every day and that way we can see the progress whether she's getting better or if she's getting worse. And what I'm going to do is I'm going to keep you updated on Instagram so all the pictures that I take I'm just gonna post them on my stories so you guys can see how my strelitzia is doing and hopefully it will be better. Of course as always if you have any questions make sure to comment below or if you have any other experience also comment below because you can help the whole community. And as always I will see you in the next one. Okay, ciao.


Hello and welcome to a presentation on the library led research information management system at Oklahoma State University collaborations and challenges. This presentation is created for these coalition for networked informations project briefing video series. I'm Clark Iacovakis, scholarly services librarian at OSU, and I'll be joined in a few minutes by Megan Macken. The two of us, along with Matt Upson, associate dean at the OSU libraries are the primary project managers and administrators of the system. This session will focus particularly on the collaborations between the library team, campus it and data owners across the university and configuring the data feeds. We'll provide a number of examples of challenges we confronted as we migrated personnel grants and teaching data from local databases to the new system. This session will include solutions that we developed for mapping complex data structures addressing privacy considerations and handling dynamic data that changes across time. Research information management or RIM system is a software platform for the collection storage and linking together of metadata related to faculty service grants teaching and scholarly activities. Essentially, it is a single point of access that is typically stored across multiple internal and external platforms. So for example publications data may be harvested from external databases like Scopus PubMed or orchid personnel grants and teaching data may be fed in from internal databases. Data migrated from existing RIM systems on campus data added manually by individual faculty. The advantage to having all of this in one place is that it can save a lot of time and increase the accuracy of reports that need to be created by universities for multiple reasons. These systems can also help researchers, funders and members of the public identify expertise within the university and they can enable faculty members to communicate their research focus and activities more effectively. At Oklahoma State University, we began implementation of our RIM system which runs on symplectic elements in late 2019. The project is supported by the Office of the Provost and the Vice President for Research and implementation is led by the OSU Libraries in partnership with IT and other university staff. From the beginning, librarians have managed the publications harvesting where we've gathered Scopus author IDs, orchids and other publications data, which gave most faculty a solid baseline of publications linked to them from the outset. IT configured our single sign on which is CAS and added the web addresses to the OSU domain. Three other data feeds were to be generated from databases in the university's enterprise resource planning system, which is Banner. This includes personnel information which is managed by human resources, grants data which is managed by the Office of Grants and Contracts Financial Administration, and courses taught which is managed by the registrar. IT has been heavily involved in all conversations from the initial exploration of systems as the vendor visited campus and provided a demo through to implementation. They asked a number of questions relating to the system, for example, single sign on options where the data is stored and backed up, what the technical architecture looked like, how data transfer is secured, and other important technical questions. Satisfied with these responses, OSU opted to contract the vendor to host the data. Hosting with the vendor allows them to manage all support questions, upgrades, backup and disaster recovery and so on. The contract with the vendor stipulates that the university retains ownership over all the data that the vendor will not provide the data to any third parties, and that our data would be destroyed upon termination of the agreement. Furthermore, faculty users can set any object that is linked to them to private or internal and can also control the privacy level of their profiles. Elements also provides for a number of roles within the system that gives flexibility over who has access to what data. Access to the underlying reporting database is held by a small number of administrators who can create custom SQL queries and make those queries or the results of those queries available to select individuals. Within the web application, people with the statistician role can run these reports over the university as a whole or different colleges or departments based upon their level of permissions. For each data feed, two librarians, Megan and I, an IT staff member and a data owner or a staff member with access to and knowledge about the data was brought on board. We also contracted with Simplectic to provide guidance and a process for formatting the data to be imported into elements. Each member of the team brought specialized skills and knowledge that helped considerably to help keep the process moving forward and to address challenges when we confronted them. For example, librarians were the project managers, we brought our experience with data mapping, building data structures, creating crosswalks and managing metadata. Knowledge of the system itself as Sim as system administrators, we received training and developed extensive knowledge of the system. We maintained contact with faculty administrators and other users of the system, and we are faculty members ourselves so we're also users of the system. And we also work to translate information and clarify goals between different stakeholders. IT of course brought their technical knowledge and wrote specialized queries to extract data from banner. They reshaped that data into the format that was required for import into elements. And they also created an FTP process for placing the data on Simplectic servers, and also retrieving log files and making those available to us so that we could troubleshoot any problems with the data feeds. Finally, the data owners brought their knowledge of what data we had in banner, what data fields were available, how complete it was, how far back it went, how accurate it was, and of course any privacy considerations as well. Elements is a private system by default and only users who are on the HR feed will have profiles and only people currently active at the university can log into the system. So our first step was to construct a file including these users. In consultation with HR, we established a criteria for who would automatically have an elements profile based on their employee classification codes. We configured this with IT and HR to include all faculty, including tenure track faculty adjuncts, visiting professors and lecturers. The feed would also pull in the individual's college and department, their email address and phone number and some other information. In consultation with HR, the feed was configured to refer to a flag in banner, indicating whether the faculty members should have any information about them kept as confidential, or if the person should be left off the feed. The feed is deposited nightly on symplectic servers to be picked up and run, updating data and reflecting changes by the next morning. So for example if someone's phone number changes or if they leave the university, the data will be updated relatively quickly. There were several challenges in constructing this HR file and I'll review some of those here. The department level data was somewhat challenging in that faculty serving as deans would be in a provost group rather than their academic departments. We therefore pulled both the department in which a person was tenured, as well as their administrative department, and Megan constructed the groups and group hierarchies based on these codes. We largely resolved the issue, though we do have a few cases that fall in the margins, such as administrators who come to OSU with tenure, who may not automatically have a tenuring department, or people who earn tenure in one department, but then transferred to another. In addition, there are people who are not automatically added to the feed but still need a profile in the system. For example, Elements includes the ability to designate another Elements user as a delegate, which allows that person to edit data in the person's profile on their behalf. Some colleges and departments have designated administrative staff for this task, so we needed to add them to the HR feed so they could log into the system. Also, some colleges have research and extension staff and others whose employee classification codes left them off the feed. We therefore worked with IT and HR to create a process for appending to the main HR feed, anyone we request before it is sent to Symplectic. IT also built a mechanism to overwrite certain data from the main feed. For example, emeritus faculty, who may have officially retired, can be set to active so that they're still able to make their profile public and modify their data. These are just a few examples of solutions we came up with to address the complex and dynamic data. Finally, IT built an application to query the Elements API whenever someone lands on an OSU directory page. This query will determine if the person has made their profile public, and if so, it will provide a URL to their experts page and add their photo. This is a great example of ways to connect different tools and data sets and a product of the fruitful collaborations we've developed. My name is Megan Macken, a librarian and digital resources and discovery services, and a member of the Elements implementation team at Oklahoma State University Libraries. I'll speak now about two additional data feeds and elements, grants and teaching. The grants feed is derived from grants and financial contracts accounting records. This is another example of data that was not intended for public view. It is managed by the grants and contracts financial administration or GCFA in banner, the same information system as a human resources feed GCFA manages award related accounting and compliance, among many other things, including business income and reporting, as you can see here on their website. Transforming this data for public view required some effort, especially at the outset, when the project team for this feed work to understand the structure and usage of the source data. The project team included a GCFA accountant, a software services manager from campus IT, Clark and me. Part of the challenge was that only the accountant was familiar with the source data. He explained the purpose and structure of particular data and various abbreviations and codes to other team members, because half of the team did not have access to the GCFA system. The accountant also found examples of unique or complex data requirements, and then created exports and screenshots to illustrate them. Screen sharing made this communication a little easier as we switch from in person to virtual meetings when the pandemic began. Overall this feed required extensive discussion to bring everyone up to speed before the data feed could be activated. Long term grants or contracts renewed each year provide a good example of the unique complex data needs for the grants feed. These grants may have different principal investigators or PIs and contributors over time, and many sub accounts or funds. The grant I show here includes mentorship of additional PIs and replacement project leaders in the proposal. So changing PIs are inevitable. With this dynamic data GCFA uses a relational data structure with a parent grant that may have many child funds. In this slide you see two different examples of the parent child structure from the NIH portal on the left, which GCFA replicates and elements on the right. Initially we tried to flatten the GCFA relational data into the out of the box structure in elements, a single grant object. The documents records the individual accomplishments of each researcher by linking that person to a single object. However, this didn't allow us to accurately distinguish how much funding each individual faculty member had been awarded. For example, one professor may be a PI on an NIH grant of over $2 million, while another professor is responsible for a $20,000 fund within that grant. For our initial flattened transformation, it appeared that all faculty on the project had been awarded $2 million. To resolve this we worked with the vendor and campus IT to create a custom solution. We now create separate child objects for grants that may have multiple funds. This way the cumulative funding amount for the ongoing grant is available, and faculty may be linked to the specific funds to accurately reflect their contribution. Correct attribution is especially important here, not only because the system generates public profiles, but also because the RIM system is used to create annual and appraisal and development reports and other faculty activity reporting. The fields within each grant or fund required some customization as well to map from the GCFA database to the RIM system. In addition to built-in fields, we created new fields for the various codes, departments, programs and agencies, including pass-through agencies, used to track grants and contracts. We fed in only the minimum necessary data needed for accurate reporting and for following up with GCFA on particular grants and funds. The vendor provided a set of spreadsheets to record decisions about mapping data from one system to another. While this process was familiar to librarians, used to migrating data between systems, it was new to other team members. The library team guided the process between the data managers and the vendor by interpreting system-specific terms for everyone and identifying appropriate target fields in the new system. When the data structure was created and the fields were mapped, we encountered additional hurdles during the migration process. Initially, delimiters within the GCFA data caused errors in the CSV data transfer. Additionally, publicly sharing the data revealed errors accumulated over the years that were previously inconsequential when the data was only shared internally. The errors were generally in spelling, capitalization and titles of grants, and sometimes contributors needed to be updated. Because the grants data is fed into elements, faculty users cannot edit their own grants data. Our solution for addressing these issues was a user ticketing system built in Qualtrics. Faculty complete a form which is automatically routed to the campus IT ticketing system. Grants inquiries are assigned to GCFA staff who edit the data. The requests to make grants private or hide them from public view are not routed to GCFA, but instead handled within elements by a librarian system administrator. Additionally, error logs notify us that some grants fail on import because they have a PI who does not have a faculty classification picked up by the HR feed. When appropriate, these users are added manually to the HR feeds, as Clark described earlier in the presentation. Once the grants feed is set up to pull data on a weekly schedule, these updates do not appear until the next weekly run. Finally, any grants connected to people who for privacy reasons are excluded from the system are not imported into elements at all. The third data feed brings teaching data into experts directory from banner, the same system as HR feed and grants feed. This data is dynamic throughout the semester added additional complexities to the system integration. For this feed Clark and I worked with the registrar's office and campus IT staff who were all well acquainted with the data. This made structuring and mapping the data into the RIM system a much smoother process. We customized some fields but not the data structure. Instead, it was more challenging to determine when the data was finalized and to establish a schedule for transferring it into elements. The teaching feed to run at the beginning of each semester three times per year to load the data for the prior semester. Classes vary in length. For example, some classes run only eight weeks long starting in the middle of a semester and instructor sometimes change after a course has begun. And of course students drop and add classes throughout the semester. We do not have student users in the system but we do include enrollment counts for the individual courses and elements. This information may appear on reports including annual appraisal and development reports. And while some faculty expect to see the classes they are teaching to appear in elements as soon as they begin teaching them. Most are content with the schedule that produces more accurate reporting and instructors who would like to have their courses in the system sooner may create temporary manual records. Only some colleges keep only local records of their clinical courses taught by dozens of co instructors. As a result, this local data does not appear in the teaching feed automatically and must be manually entered. We provided some guidance to the administrators for this college for working around this issue, including the recommendation that they explore avenues for moving that process into banner. This research information management system implementation involves similar processes for the human resources grants and teaching feeds. However, the data documenting faculty activity on campus is complex and dynamic. While all of the respective data sources derived from the same information system banner, the structure tidiness and management of the data varied widely. There has been clear intentional communication with stakeholders across campus, including the registrar human resources, financial administration, and the faculty whose data was represented communication across all of those groups was vital. The library led implementation team, who are also faculty members served as project leaders, as well as conduits between data managers and other faculty users. This positioning enabled us to work through obstacles, such as the examples given here in shaping the data and establishing workflows. Effectively to build a room system that supports faculty needs for annual reporting and for public profiles, and to configure a system that fulfills the reporting needs of departmental and college administrators and for the university as a whole. Data structure impacts activity reporting over the long term, and may also influence the perceived performance of faculty and departments. For this reason, the extra effort we made to understand the nuances of each data source and to create avenues for rectifying inaccuracies was an essential part of developing our room system processes. Thank you for this opportunity to share our project with you. We'd love to talk with you more about it. For more information, please contact us directly or visit our support site and public profiles page at experts.okstate.edu. Thank you.


I'm glad so many of you came out of church to be here this morning. I know it's difficult. This morning I want to talk about something fairly serious, security testing, because it's pretty much generally worldwide done completely piss poor. So put on your silver faces, wake up a little bit. I may even point at some of you and ask you questions. And if you're not awake or you don't respond, I'll ask you to leave. It's that important. My name's Pete Herzog. I'm the managing director of ISACOM, which is an open source research, security, collaborative community. Basically I manage all the projects. I began by being the creator of the AUSTOM and I'm still the main developer of the AUSTOM. Yes, the OSSTMM, open source security testing methodology manual, which the British started calling the AUSTOM. It works for me. So yeah, I brought ISACOM as the managing director, mostly the volunteers, the groups, not the operations. We have the AUSTOM, we have Hacker High School, we have business integrity testing. We even are doing open trusted computing as part of the trusted computing consortium here in Europe with HPE, IBM, SUSE, a big group trying to bring transparency to trusted computing, which is actually very, very closed right now. And even we have groups like Infineon who make the trusted platform module as part of it. Goals and ambitions? Well, you want, I'll be talking throughout this talk about my lofty goals and ideals, which is basically to make security better, to make it better how we test security. And that's really important to understand because we are all dependent on somebody else doing their job right. No matter what we do, whether we drive a car, we have to make sure that the guy who put the tires on the car wasn't asleep that day. It's so dependent on what everybody else does that my job, as I see it, my mission, my goal, is to make sure that security is done right and that it's not my fault for not telling people how to do it right. I love the Eureka moment. I love it when an idea works, when things come together.  I really hate when people say, well, I didn't do it because I didn't know. And if it's your job, then it's your job to know. Unfortunately, there's nothing like malpractice in the security field. So as far as I see in security, any type of ignorance, if you're a professional, is malicious. So a quick overview of today. Security testing is complicated. Verification is always something you should do yourself.  And there is a trick, quickly sizing up security. And I'll teach that to you if you're nice to me. Make it cool. The problem is that testing security is innate. And so is protecting. So whatever we built... Oh, sure, left the speaker. Okay. Anything that we want to secure is innate. As developers, we build things. But when we build things, we build them so that they work the way we want them to. We have an idea of how they're going to work. And generally, any failure in how they work is a problem. It's an issue. And even though we like to think of security as threats people attacking, it's also as simple as building a wall so that the wall doesn't... Okay, we'll try this again. So when we build a wall, we have... The last thing we want to do is test it by pushing it over. Because what if we're wrong? And the wall falls weak. While we build that wall, we are thinking that wall has to stay up. Because we don't want the consequences of what happens when it falls down. Or work. Builders. We have a problem with testing our own stuff. Our own things, which is part of the problem. Other issues are interviews are biased. People's knowledge of security is very subjective to certain rules of the game. The problem is, can analysis. Because then you find that what the tools will do is discard responses it receives because it wasn't expecting it from the experience. If you're in security, you will be constantly, consistently humbled. You cannot be arrogant and be in security. It just doesn't work. Okay? You build a better mouse trap, so it makes a better mouse. So it's only cool proof, so it makes a better pool. That's just how it works. Now a lot of people like to say the main issue of security is risk. Risk is not security. Security is protection. Risk is a statistics game. You can play that game if you want or not, but it's very subjective. This one? It uses me. There's a new thing in medicine called evidence-based medicine. The whole point is actually being, it came out in the 90s. It's growing in popularity. And it's about having the doctors actually use science to diagnose people. Yeah, this is new. You'll actually see it starting to come out in more and more magazines. It's a big deal. And the reason why is because obviously we know that certain medicines affect you. They have side effects. They may even cause kidney, liver damage in addition to healing you. So now with this evidence-based, they're looking at maximizing your lifespan and quality of life. So for instance, they may not give you a drug because your problem, your cancer, your disease may not have an immediate effect.  So they start looking at these things and your quality of life. And so I like to think of this as evidence-based security where you're actually looking at the big picture. The only problem is it doesn't work in emergencies. It doesn't apply to everyone. And the biggest flaw when actually using science for security is the CYA problem.  People don't buy it.  I bought HP. I bought Ernst & Young. They came in. They did their job. I'm clean. Okay? So the only people who actually buy into the scientific method, who buy into eSYCOP, who come around, are the people who actually need security and not compliance. So if you actually need to secure something and not just have a paper that says you're secure, you're going to be looking for this methodology. Quick quiz. You've seen in the sky, I assume here in Belgium, you can see in the sky, geese or ducks fly overhead and they fly in this D pattern. You all seen that? Pants, wake up? You've seen it? Yes, no? Okay. And one line of ducks is always longer than the other. You know why that is? The answer is there's more ducks in it. I think we know what we're doing because we are subjective. We need to test more. We don't know why there are more ducks in it. Okay? But we do know that there's more ducks. But we answer the question of why is it longer? Because there are more ducks in it. And this is a problem with analysis and security. And we're going to talk about that. Hopefully we have time. Basically, as human beings, we are subjective. Our minds work in a certain way where we apply weight to different risks, depending on how important it is to us. We're definitely not objective about it. So, we needed to look at something new in the way we perceive and define security. And we did this in the Austin, which is under copy left. And the methodology is under the OML, the open methodology license, something we had to create because the methodology cannot be copyrighted. A methodology is considered a trade secret. So, we designed a license for an open trade secret. Basically, the idea is that somebody else can't say it's our trade secret. So, what do we do new in the Austin 3? Well, we want to categorize security into calculable components, clear definitions, security metrics. We started adding things about test errors, test types, vulnerability classifications, blah, blah, blah. We wanted it to be practical for the auditor as well as the developer. So, the developer would be able to quickly size up security in what they're developing while they're developing it without needing to resort to some huge manual or checklist, which is often dated or wrong practices. So, the Austin 3 is completely new research. It's actually been researched, which is why it's taking so long. And for all those people who say, hey, why does it take four years for the Austin to come out? I want to ask you, who else has security metrics that actually work? Yeah, they've been working on it much longer than us. Okay, let's look at the security test defined. What is a security test? Well, the first thing we want to do is we want to measure operations. We want to know how something actually works. If we don't know how it works, we can't tell you how it's not working right. So, it's important to actually understand how something works. Then, we're able to apply measures, security measures, which are actually a good fit. From there, once we actually know how it works, what security measures are there, then we can start our risk analysis. But we completely keep bias and risk out of the Austin. There's only one place where it even shows up a little bit, and that's where you self-assess your own errors. And we do that for two reasons. One, because it helps you learn more. And two, it helps your client or whoever you are testing or auditing understand the difficulty level of the job you just did. It's not an insult to you if you have a lot of errors, because it could be the network that you are testing produced a lot of errors. It could be uncooperative cis-admin. And the beauty of it is that you actually get a report that you fill out at the end where you explain these things. So, you not only say what you test, but most importantly what you did not test. So, later, when another company comes along and does an audit, you could actually compare the two for thermos. This testing, we found that on a fundamental level, it was done wrong in a lot of places. We actually had the community push us to make a certification. And the reason why was that way they could hire people that they knew could hit the ground running, that they could work immediately, and they would know what to do. So, we ended up making two certifications for that in testing and analysis, the OPST and the OPSA. And just to give you a little bit of an idea of how they work. For something like the OPST, you'll have to define things like where's the physical location of a web server over the internet. If you have three different services on the server, returning three different TTLs during your port scan, what's actually happening? What kind of increased data do you need to collect in order to come up with a better analysis?  But then when you tell that to it, you don't get a response. Anybody want to explain why that one? Go ahead. Transparent proxy. Brilliant. Good idea. That's one way to do it. How would you check? What other tests would you need to do? When would you consider yourself done though? How many more would you test before you decided that you've tested enough? What's the magic number? No, it could be as simple as looking at the TTLs. You're going to have a shorter TTLs because it's closer to you. That's one definitive test. And yes, you could make more tests and see that it's happening. That it is a coincidence. But that's how you do it. And this is what we show. How you come up with the new tests on the fly because you're always going to have new technologies. You're always going to have new issues while you're testing. And we want people who can actually think for themselves and not just run a tool to be able to come up with the new tests as it comes up. So we had VPNs, then we had SSL VPNs. And I know a very large company who was looking for somebody who could test security tests, SSL VPNs, or procurement. The problem was is that the answer they always got back was nobody's ever really tested SSL VPNs before. Web tests. The problem was is that these security experts weren't defining new tests. They were stuck with a new technology. So this is what we try to bring into people. One last thing, by the way. Telnet is not the protocol for web. So that could also be your problem. In analysis, we do the same thing. We want people to be able to hit the ground running. We want, more importantly, the people you do business with to actually understand what the heck you're talking about. So we try to teach analysis, which is actually the OPSA is a harder class than the OPST. So we always recommend it second. But we look at the things like the famous trace route. You've all done a trace route, I assume. Well, a couple of developers probably know. But when you do a trace route, sometimes you get back the little stars. Sir, why do the stars come back? Yes, you. I see three packets. That's what you put on the report. What was the first part? I think it's an option 10. The router is not returning.  You get an old star. The only thing he knows is that you did not receive a response. You don't know why. See if you have this innate thing where we think we can assume based on our experiences, which is why we'll always be taken over by robots someday. Let's give some background information. Let me define for you what security is. It's something which protects an asset from a threat. Okay? Basically, you're actually separating the threat from the asset. So three combinations of doing that is, you move away from the threat. Okay? You're afraid of lightning. Your threat is the lightning. So you move inside a mountain. Okay? Your threat is terrorists, so you close all borders. Okay? You eliminate the threat. Some countries go after the threat.  Not going to say, I'm sure you guys may have come up with an example. Or you convert the threat, which is something that was very popular back in the early days of Spain with the Spanish Inquisition. And we can see that any way that we apply security it's usually fairly drastic. Safety, on the other hand, is where you'll learn to live with the threat. Basically, you want to control access, process, interactivity, or the impact of the threat. So that's where you get things like your authentication, you have people traveling with IDs, all sorts of things that you want to do to lessen the threat. So of course, if your fear is lightning, maybe you walk around in a faraday cage. Okay?  Okay? So now that we understand the difference between security and safety, which apparently the dictionaries don't seem to understand, we can actually take our concerns with how security works. Okay? So what this means is that we don't have to care what they have for security solutions. We care how it works. Okay, everyone here might be familiar with the PCI data requirements for these investor cards. Some of you might know that. Basically, you have these checklists. And actually, anybody who works in the government will know these checklists. Or if it works with BS779, you will know the checklists. And they ask you things like, are they running antivirus? What the actual question is, does antivirus even work? And I'm not saying that they update every day. I'm talking about they've got a whole slew of lackless technologies that they're running. Lackless technologies. And they're calling that security. By the way, antivirus and security. Which I just said that now that this goes on the web and all of you know that, we're never going to get special funding from Samantha. So I still sit down with them and take them on them. So basically, we divide it into minimalized operational security or offset in the biz. Into visibility, access, and trust. Visibility is your number of targets in the scope based on an index. Index is how you help them. By IP address, by MAC address, by person, by street address. There's ways that you can help. And from a vector, from the inside, from the outside, from within one new vantage point versus another. Basically, your visibility is opportunity. If you know something is there, you can attack. Access is your unique interaction points. So basically, any place where you can have an interactivity could be a service. It could be a kernel response, like for ICMP. Or there's other ways of doing it, like in a physical security audit. You have doors and windows, which actually open. Those are interactivity points as opposed to the ones that are sealed shut, which are not. And then you have trust, where the targets actually interact with each other in an open manner. Like a web server, or a database server, or an internal help desk that will not identify the people who call if it comes from an internal number.  Just take a seat. You have your class A and your class B. We got really clever with our labeling. So just go with me. The problem is that any time you label anything, you make the people who don't know a damn thing get very angry about vocabulary, because people actually like to argue. Yeah, it's human nature. We like to argue. So of course, if you label something, they're going to argue the semantics or the definition of what you label. And this is where I take a step back to just go with the definition and I don't care what you call it. So here we have the interactive process. We're going to go through them. Your interactive controls are authentication, blacklist, whitelist, tokens, passwords. Indemnification, which is the covering rest, basically take out insurance on everything. So you have an asset. An asset. You take insurance on an ex-asset. If somebody steals it, you get big money. You don't care. Even better in data security, you have asset. Somebody makes illegal copy of said asset. You still have asset. You still sell it. You get big money. Resilience. You want to be able to control how something fails so that it fails securely. It fails closed.   And magically, he falls against the door and you can't move him. He's so big so the door stays shut. Gets hit, falls over. Make sure everything is closed. Subjugation. Basically, the controls are handled by the people who make the controls. So basically, you've all seen this. You go someplace. The guard gives you the paper to sign yourself in. He looks at your ID, gives it back to you. You finish signing yourself in. That fails subjugation, which means he should have signed you in. Because now you can have signed anything you wanted. You think he's going to remember every card he looks at. And you see that everywhere. You also see client-side input filters and browsers. It was huge with JavaScript for a long time. Probably still is. And then, of course, when you mention people go, oh, server-side JavaScript. Continuity. Basically, there's no interruption in the interaction. So the grocery store, you want to go check out the counter. Full, full, full. But they keep putting on new cashiers. So basically, they can handle any volume. And they keep putting in more cashiers as you need to. Door is blocked. They have a secondary door. You can still come in and out. Business service doesn't stop. So we also know this as survivability, load balancing, redundancy. We want to avoid the single point of failure. This is actually a big deal. As you can notice, it's actually at odds with resilience. Because here you want the services to keep going. And on the other side, you want it to fail securely. Nonrecruitation. You want to make sure that you know all the actors' roles within an interaction that they can't deny it. Confidentiality. This is the big one. Basically, you're looking at anything that's displayed or exchanged between parties is seen only between them and not outsiders. And yet, we still call that privacy. When privacy is actually the asset is displayed or exchanged between parties in a way that's only known to them. Okay? So that means you have this, and you've seen this on pretty much every TV movie that deals with bad guys and drug dealers and stuff, is that they know the drug deal is going down. But they have to catch them doing it in the act, and they don't know where the deal is going down. So of course, all of a sudden they just know that famous Miami drug dealer shows up in town. Okay? Famous other Belgian drug dealer shows up in town. All of a sudden, they both walk away and one person buys a Lamborghini and the other one, you know, pies a kite. So the problem is privacy. They actually didn't see the interaction happening. So they couldn't prove that it happened. Hence, business you do behind closed doors. Integrity is your control over any undisclosed changes. The only place where I actually see this working really well is with any kind of patching and five-patch sort of thing, or PKI. So by the way, it's not realistic. And then of course, alarm. So any kind of notification that safety is failed and circumvented. So you have to wonder, things like IDS alerts. Is it an alarm or is it not? Server logs. If nobody reads them, if they get ignored, is it really an alarm? Okay? And then of course you have something different, like home security systems where something enters a door, there's a little passive infrared thing. And so there you can actually block your access point with an alarm so that way when it's open in any way whether it's the lock that's broken or the door that's broken down or when they come in through a window, the alarm still sounds. Then there's a third part of this called limitations. And here you have your vulnerabilities, weaknesses, concerns, exposures, anomalies. Yes, we classify five ways. You'll see the CVEs basically only use vulnerabilities and exposures. We have mapped pretty much one-to-one with the common accepted way of classifying things but we do it a little different because the normal way of classifying vulnerabilities actually doesn't work. If you've noticed over the years people keep rehashing old ideas there's nothing in any new research. Our new research that's come out has shown that there are better ways to classify vulnerabilities yet in order for it to be accepted it still has to be sort of like the old way so that people don't get confused and whether or not you want to call it a vulnerability weakness or ADCVE we don't care. Don't come back to the definition that's not what a vulnerability needs. That's what it needs to be.  That's a vulnerability. A weakness, very simple. You can pretty much anybody could use this to figure it out. The risk that's involved in that happening is a completely different issue not our problem. We're just doing a metric for security. The weakness actually depends on the class A controls the class B controls for concerns exposures deals with visibility and anomalies are anything that's unidentified or unknown that can't be accounted for. Now the beauty behind this is that we don't give it multipliers. We don't say this one is worth 5 times as much as this one or this one which is only worth 1x versus this. That's obscene, biased old school thinking of eating 4 eggs in the morning a day and a heap of bacon. That belongs back to the 50s and that's still what they're selling. Instead what we said was based on the controls and the operational security that you actually have in place right now that's what determines the values that go here. So this is actually dynamic. How much one vulnerability is worth depends on how many controls how they work the controls because actually you can have a vulnerability in a control itself or the security that you have in place. So yeah, believe it or not the value of a limitation actually depends on the security controls you have. What an amazing concept. That's right, I'm the genius that came up with it. I can't believe somebody else didn't come up with it. I think somebody did, they worked for a corporation they got fired and basically we have this beautiful sheet that you can download it, you can use it yourself so you don't have to do math. You just have to count and most of us can do that counting real integers is fancy.  Okay? But all of a sudden here we see that there's not nearly as much weakness. You'll get this the many other controls you have in place you can have a weakness or concern or even exposure for more than vulnerability because it's dynamic it's rare and you have to have some pretty screwed up security to get it but it happens. So basically we look at visibility, we found 250 servers systems and up to 412 access points and 14 of them had trust from this method that we can tell we can also count up the rest of the cards. Okay? Now the beauty of it here is that 10 controls both 10 nullify one offset. So for every all 10 controls combined is basically the same as having that whole closed. So what that tells you is that you have an open service tell net control controls except authentication. So basically the value of that whole is 0.9 out of 1. So it's still pretty wide open. SSH offers integrity, encryption confidentiality, integrity and authentication. So you're already up to 7. So it gets even better. Each limitation's values depend upon the object control values. So if you add more controls it changes that there in which case your final delta of a change happens is influenced.  So for example if this was a network one network out of two networks two companies combining and you already had the other value you could actually combine the two values and say this is the change that would happen when we add their network to our network. We could already predict the security change which I just talked ahead of myself in the slide. Okay. So for some fun and games we could ask ourselves we could answer these questions theoretically before we try it. Is one network firewall better than a host firewall in each system? Or does two factor authentication work better? So we can basically look at this and we say alright here we have minus 9 a firewall no controls because each one has a host based firewall on it. So we've got minus 9 for changing security. A network firewall adds one additional visibility it's an additional system and a single point of failure. So it has a new weakness and we've got minus 15. What do you think people are doing out there in corporate world? We know what they do. They do the single firewall because it's easier to administrate which isn't actually true if the administrator actually did their jobs. How many administrators here? How many? How many of you are lazy?  Alright. Just go for the clock. Okay. One factor authentication you have four to five systems each with one each with one service open one of those has only one of those services has an authentication so we've got minus 7.9 and if you add an additional authentication to that service you're at minus 7.2 So it makes a slight bit of difference but two factor authentication also means a huge cost because you're talking about tokens and all sorts of new tricks so you can actually then see if it justifies the cost. I'm almost done here people. Now your party tricks because you're also nice to me. These are fun. You go to attract a guest to the party and you explain to them which room is more secure the living room or the bedroom and they should go with you. Come on you can do it in your head you can calculate the opposite access, trust just tell them in those doors how they open it's a great trick. Some of you are going to try it if you don't. You explain to the host exactly how secure the silverware cabinet is and then you test it. Huh? Tricks for your friends. Then when the police come to the house and they explain to the flight officers you can tell them exactly for slicing the security metrics that just because the house is rocking then it's still very safe and they'll just go with because they can't do science except the forensics practice instead of the other police. Okay to wrap it up some keys to proper security testing for the BIOSTA using the scientific method transparency tell it what you didn't do as much as you did do you don't rely on pattern matching meaning just because your experience says that the router didn't respond so that ICP packet doesn't mean that that's always the case your intuition is a weakness in a scientific methodology meaning what you think works uh you know or what your gut feeling is is probably statistically wrong and you won't know that unless you actually try it and do the test and you're consistently right all the time which some developers sometimes are but they're like they're like one gene away from being a robot anyways you want to be very formal in your verification process that means you actually test it formally and not just cut corners you want to recognize when something is in a hostile environment meaning that you're going to have a lot of interactivity that you did not cause yes, when you test it on the internet other people on the internet might be going to go servers at the same time that's right it's dynamic so I must forget that and common criteria is a good place to start when you're trying to figure out things about systems but since people get to make up their own criteria before it goes into it it's not always correct but it does give you some good ideas like for example Microsoft we know is not designed for hostile environments and they know that and they admit that yet legally legally they can sell by a server that goes with it they can package internet utilities, internet applications for a product that they knowingly know cannot be in a hostile environment and I say Microsoft but it also includes a lot of Linux's too so it's not designed quick thing about authentication if you're interested basically these are the walk the walk things even if you guys don't want to take it you might want to consider hiring somebody who is if you're looking for somebody who knows security it's pretty much a standard or if you want to hire somebody you want to make sure that they actually know what they say they know this is a good fundamental if you're looking for a good security person you can actually think and develop tests on the job no robots so we have the analyst we have the tester any questions, any information? does the CVSS fit into the Austin how does it work? sure anything can be integrated into the Austin in that way I don't particularly think it works but that's my opinion I haven't done thorough testing on it but I think it's very biased and in a security task where you try to say something about operations in a factual manner to integrate something biased into it where you don't specifically say in the report or to the client that it's biased you are lying that's where you find limitations within the authentication scheme sorry the question was do a video up there what happens with the strength of a password or the existence of a password in an authentication scheme do we just count or is there any kind of weighting to it the point is that there is no weighting it's just you do test it and if you find vulnerabilities or weaknesses or concerns in the authentication scheme itself then that also counts against it does that make sense? you're still testing the controls controls you can have for instance you can have antivirus but antivirus is just a blacklist and your tests are going to find that it has lots of weaknesses depends on how good the password is and how bad the token is that's why you test it I think we're out of time here almost anything else? anybody else? he says we're not so easy questions now only easy questions favorite color favorite animal, unicorn nobody? can I explain why I don't talk about risk? risk is biased and it's different for everybody so for example maybe the thrill of jumping out of an airplane is worth the plunge 10,000 feet to your death because you really like it it's a different thrill for me it's very biased so we would have a different risk weighting system towards something like that the Austin itself is a platform for risk so you do the metrics you actually have a foundation that's solid then you add your risk then you can say well this vulnerability is used a lot or we see this in the wild or any of the opinion you want that goes in your summary or your report but at least have the foundation of knowing what's even there first somebody else? yes as a matter of fact I do know that certain governments do, we find it in Switzerland, Germany Mexico United States Treasury Department recognizes it I guess you could say we train a lot of people a lot of departments not that many I hear from they don't have to tell me if they use it but I only hear second hand so I can only say on the side who talked to me or who told me, for example my biggest one I was talking about yesterday was that I heard from NASA Ames Research and for me that's like the geek mecca you know those are rocket scientists so for all those people who hate me that's okay because I got NASA but yeah, they don't have to tell me or it's nice if they do but I don't know but I think it is pretty much prevalent, I keep hearing from places that's it okay I gotta catch a cab and catch a flight back to Barcelona where it's warm


We've been operating the F5 since 1989 and we've never been able to do this. The launch in 12 aircraft at the same time is an accomplishment for any squadron, but the fact that it represents every single aircraft that we own and in fact every single F5 that the Marine Corps own made it that much more special. The mission of Marine Fighter Training Squadron 401 is to provide adversary support to the entire Marine Corps and this allows our forces to train against those actual tactics to learn how to counter them and provide realistic training so that when they are up against it for real will make the right decisions and of course the win decisively but more importantly will survive. Taking off in a 12-ship formation and trying to control that and get into the airspace back out was challenging in many respects and it's difficult to fly that many aircraft in formation but the officer in the squadron did a phenomenal job.