And today I will talk about a new topic for me, so database DB2 security. And if you look in the internet, normally the first way is always to go to Google and search for DB2 security experts, but so far there are no real DB2 security experts available. And I think the majority of the security crowd is not looking at vulnerabilities in DB2. And today I want to show you a little bit of my research and also give you the resources with links to VMware that you can also start a little bit research if you want because I think it's a juicy target as well. Okay, I'm not sure who has experience with DB2. Okay, a few, I have difficulty to see. Okay, and when I start looking into a new topic, everyone is looking at Google. And my experience is that IBM is quite slow in releasing patches, so that's one of the first thing. Even after zero days were released, it took a few months until they released new security patches. The latest version of DB2, L-O-V, Linux UNIX Windows is version 9.7 called Cobra. And this version will be supported until 2014. And here you can see when the patch sets are coming out, the fixed packs. Then we have version 9.5 and version 9.1. And 9.1 will run out of the normal support end of 2012. So people should start slowly thinking about migrating to 9.7. One of the questions and in the IBM world, it's much more complicated to get the database software. You can get the free express edition. And this free express edition is available, thank you, for different platforms. But in some places they are quite limited. For example, the express edition does not support PLSQL and some other nice things. There are also trial versions, 90 days available from IBM, but you have to register. The biggest problem for me, if you don't have a support contract with IBM, is to get old versions. Because if you're looking for security vulnerabilities and if you want to play with exploits, you're normally more interested in older versions than in newer versions. But that's quite complicated to get. There are also some VM-based images available. One is created by a guy called DB2 Hitman. And he has Ubuntu version. So you can just download this VM and then you can start playing with it. So that's probably the fastest way to start with DB2. Because you save all the time to set up and configure the database. And there are also express edition and IBM has also a data server, but sometimes it's difficult to find. So whenever I want to download the IBM website, for me it's a nightmare. So I have always difficulties to find something there. So this is the architecture, but I don't want to spend too much time here. For me and many other people, the first time when you work with a database, probably the biggest challenge is how to connect to this damn database. So I saw it so many times that people want to connect to an Oracle database in the training and it took sometimes 30, 40 minutes before they were able to connect with their laptop to the database. So Oracle has the IBM DB2, they have a small command line utility CLP and you started DB2 CMD, then you connect to the database and then you can run statements. It's not nice, it's not ugly, it's similar to SQL plus. A little bit more convenient is SQL plus clone from IBM as well. So if you install it, it's part of the installation. It's called CLP plus and you have even a history, something SQL plus doesn't have in 20 years. Now I want to show you exploits and if you search in the internet, you will only find a few of these exploits because most of these exploits are coming from IBM itself. Because IBM is releasing a lot of exploit code. So if you go to their support pages, you find a lot of working exploits there. The problem that IBM guys are not aware that this code is exploit code. And I will show you some of them. So far there are only a few exploits available. If you come from the Oracle world, it's really a small amount of exploits available. So one problem, Oracle, I always say Oracle, I did it too long. DB2, they have problems with unsecured random numbers. This was fixed in 9.7, fixed pack one. And the majority of the exploits in the DB2 world are denial of service exploits. So whatever I saw, it's crashing the database, creating a denial of service, killing something and so on. In 9.7, it's similar, okay. So unsecured random number, if you call the random number generator two times, you're getting the same value back. So this is not always a good idea. And this was one of the few zero day exploits, Russian guy released zero day exploits and it took four or five months before IBM released fixes for it. So by running such a simple select statement, you were able to crash the database. So the load went to 100% and stayed at 100%. So this would be a candidate if you have a SQL injection in a web application, you can just use a union statement, append the select statement, and then you are able to do a denial of service. Somehow my keyboard is not working. So this guy from Ukraine, Dennis Yurichev, by sending this special package, you were able also to create a denial of service attack. And Dennis was also reporting another one, but it's too big. So by using fuzzing, I'm quite sure you will be able to find a lot of vulnerabilities there. And this is one of the exploits from IBM. And the easiest way to find these exploits is, you go whenever IBM releases a new fix pack, for example, fix pack four or fix pack three, then you go through all the security bugs and you should also go through the instance crash bugs because the majority of the database vendors, they say, if you crash a database, that's not a security problem. So if you run a select statement and the database dies, that's not a security problem. That's opinion of IBM, Microsoft, and also of DB2. And only if you release it to the press and you explicitly say that's a security vulnerability, then they are fixing it. But the majority of denial of service and database crashes are not handled from the database vendors as a security bug. And this is a good example that the entire quality of DB2, I talked also to several DB2, DBAs, is not that good comparing to Oracle. For example, here you have the problem if you have a duplicate predicate. So if you have the same condition two times, the database dies. So this was fixed few months ago. And that's really weird that if you use the same condition, a database dies. So the entire passing engine from DB2 from my experience is less stable than the engine from Oracle or SQL Server. SQL Server is the most secure for my. And then also if you use special construct, for example, a single byte partition. So you create this object and the database dies. And you get this entire code as a test case. So the database vendors say it's a test case. In the security world, it's an exploit. You can get it from the IBM pages. And I think IBM should rethink about their strategy to release this kind of code to the public. Also here, if you create such a table and run a select statement against it, then the database dies. Here we have this. Also here, if you use a keyword as a column name, you have the same problem. But it's not that bad for IBM. If you look at the Oracle side, it's quite the same. So if you use really weird SQL statements, the chances that you crash the database are quite big. So especially if you use reserved words, if you use short words, if you use special characters and so on. And here it's quite difficult to protect against these attacks because there's no privilege which could be revoked. You just have to wait until IBM is releasing a bug fix. Also here, OuterJoin is probably one of the most complicated constructs Oracle in the last few years. And also IBM and Microsoft SQL Server, they always had problems with OuterJoin. And here by using this OuterJoin, you can crash the database. Sometimes you're also getting wrong results. Also by using weird insert statements, you can also crash the instance. That's also one of my favorites. Just by using a lot of union statements, you can crash the database.  But it's not a security vulnerability for IBM. This was one vulnerability on the command line. So there's a small program from IBM called DB2 License Manager. And with this DB2 License Manager, you can change the ownership of a file. So normally DB2 does not run with root privileges on a unique system, but using this DB2 License Manager, you are able to change the ownership from root files and other files. So you see there are a lot of potential issues there, but comparing to, if I compare the different databases. So in the Oracle world, you have 10 times more vulnerabilities. And IBM DB2 is between Microsoft, which is the best system so far, and Oracle, so it's in the middle. And the fixed packs are normally the most interesting way to find new issues. So just go to the websites, look for everything which can crash the database. It's also a good idea to do this on the MySQL bug database. Just look for database crashes or for strange results. And then you can often create your own exploit for it because the majority of administrators does not have the time to fix, to apply all the fixed packs just in time. It often takes months or years before they apply the latest fixed packs. So that's common for all the big databases. What I also saw, and so far there's no paper about it, SQL injection in custom PLSQL code. Because a lot of database vendors, database developers are creating their own start procedure code in the database to be more performant. And since DB2 9.7, there are now two possibilities to write your own start procedure code. One is SQL PL, that's the old classic version. And the second possibility is to use PLSQL. So they license PLSQL from the Postgres guys because they hope that Oracle customers will switch from Oracle to DB2. And here is, before we look at the SQL injection vulnerabilities, two, three nice things, which are helpful if you work with security, a lot of the interesting commands cannot be executed from a select statement. Something like exporting a table or describing a table. That's not possible from a normal SQL command. And to circumvent this problem, there's a built in start procedure from IBM called admin CMD. And with this admin CMD command, you can run from SQL these DB2 commands. So for example, we can export a file or we can kill a session of another user. But it's clear that you need advanced privileges to call this start procedure. There was a few months ago, there was a problem with a start procedure called monreport.currentsql. In some fixed packs, it was granted to public. And this start procedure is revealing the entire SQL cache. So all the statements which were executed by other people are visible via this monreport function.  But it's also a security problem because every statement also insert into a password table. This statement is visible in this current SQL function. Or if you are inserting numbers into a credit card table, it's also visible here. That's why you should be careful with this start procedure. And sometimes if you work with SQL injection, it's interesting to know how to create a semicolon separated list. So this is useful to get more out of a database. So if you're doing SQL injection, you're normally getting row by row. So if a query returns 100 rows, you're getting 100 lines. And with this statement, it's possible to get a semicolon or here a comma separated list in one row, one column. So this can be useful for SQL injection because with one SQL statement, you can get the entire table back instead of enumerating it row by row. And it's special because every database vendor has its own special dialect. It's not part of the normal syntax. So every vendor has a different approach. So in my SQL, for example, it's called GroupConnect to do this. So now we are looking at vulnerabilities in custom code. And all the code I reviewed so far in the internet and also at the customer side, both vulnerable. So I never saw database developers doing input validation. So it's difficult to understand why they are not doing it. Probably they think we are too close to the database and nobody will ever inject code, but that's not the case. So here we have a typical example. And you can see even without DB2 or database knowledge, you can find this vulnerability. We have a stored procedure, administrate our current privileges. And here we have a parameter OS user. And you see there's no input validation. So the input validation here is missing. And the developer of this code was doing the following. He's concatenating the value of OS user, which is coming from the stored procedure. And this is concatenated here. And after that it's executed. So this is one vulnerability. The second vulnerability is a second level order SQL injection. So the developer is trusting that the table names are always sanitized. But as a developer you can never guarantee what is the real table name. For example, you can create a table called exclamation mark IM, or you can use minus minus in a table name. In this case, this custom code is concatenated without doing input validation. So whenever you see such code, you should try to find the responsible developer and he should use bind variables, or if this is not possible here, for example, then he should do input validation. So he has to validate that the table name is proper and you have to validate that the OS user is in the right format. And here another example. And if you go to the internet, it's really easy to find vulnerable code because I never found people doing input validation. So the chances that you'll find something are really, really high. So here we have two parameters, V-old table schema and V-old table name. And you see here they are just concatenating the values without doing input validation. Or here it's similar, they create a string, concatenate everything together and then they call this with admin CMD. Here's one limitation. If you use admin CMD, you are not able to use command signs. So you cannot use minus minus to put something at the end or you cannot use a semicolon to expand the query. Since DB2.9.7, it's also possible to use PLSQL code. And with PLSQL, you have a bunch of new vulnerabilities coming into the system. So the way in the DB2 version of PLSQL, you have to use DBMS SQL to create dynamic SQL statements. So the problem here is we have a function, this function looks if the table is empty and we have a parameter, the table name. And this table name is concatenated to the query and the query is executed here with pass. It's passed and then executed and fetched. So if you use a union or a minus minus at the end of this parameter, you can extend this query and you can run whatever you want. And this is quite common and whenever you do a security audit for DB2 databases, you should also look at the custom code because the vendors are getting better and better, but typical database developer, they do not get money or time to develop secure code. That's why you will find a lot of these vulnerabilities. In my experience, the fastest way to do it is just extract the entire stored procedure code to a text file, to one big text file and then use the CREP statement or use a text editor and search for strings like execute immediate and DBMS SQL. And then you can search back for example here, DBMS SQL execute. Where is it coming from? From this parameter and then you can search if the parameters are validated or not. So it's not real magic. It's quite simple and easy way to find this. And for PL SQL, there's a source code analysis tool from Fortify, but for SQL PL, I'm not aware if there's source code analysis available. But I think doing it manually is also sufficient if you don't have tons of SQL PL code. What is also interesting is how to escape from the database. So the typical ways to escape is read or write files, access the network, send something to the network or escape to the operating system and then from the operating system to a different system. And accessing files, there are different possibilities available in DB2. So you can use the load data command, you can import, export, you can use a user defined function and new is UTL file and DBMS LOP from the Oracle world. And I, so in the Oracle world, UTL file and DBMS LOP are granted to public, which is not a good idea. And what do you think is the default configuration of DB2? It's also granted to public. So with load data, it's quite simple. With import, export, I played a little bit. It's by using this ADM CMD, it's quite easy to use. So you say export to and then you are creating a test file. And what I did on my test system on Windows I was able to override the boot.ini. So this export command does not protect your files. So if you override executable, this executable is overwritten by the export statement. So you can use it for a denial of service to destroy files on the database server. The third possibility is a user defined function. And for user defined function, you need a start procedure, create read file and the read file is calling a user defined function. And in the sample code from IBM, this is granted to public, which is also a bad idea. So if you play on the test system, you should not run it to public. And additionally, you need to see function and the see function is here limited. So you can read a file from the operating system. And the usage itself is quite simple. You say select start from table and then you specify the function and you see the result from the file in your statement. So it's really easy to use. Next possibility is UTL file to use PLSQL in DB2. You have to set a special environment variable. And I would recommend not to use it. So if you don't need PLSQL, you should remove it from the database. Because I think in the future, you will find a lot of vulnerabilities here. And I'm not sure if it's a good idea to use systems, to use a language from a different database vendor. And if you use it, then you should revoke all the public privileges. You should revoke the privileges from public. You can also remove files. So if you look at the documentation from the UTL file package, you can rename files, you can remove files. So whatever you need on the operating system level can be easily done with a simple PLSQL function or anonymous block. The second possibility to read files is the function dbmslop. And here we have also function. Oh, that's a copy-paste failure, okay. Accessing the network, I haven't found something from the original db2 part, but the Oracle stuff in db2 has two problematic packages. One is UTL SMTP and the second UTL mail. With UTL SMTP, you can write a small dot procedure block and then you can define the message, the date, the SMTP server, and then you send the email. If db2 is configured, so for using UTL mail, you have to configure the SMTP server in your system. And in this case, you can just use this call utlmail.send and then you specify sender, recipients, and so on. The last thing, accessing operating system, I found so far only the way via user-defined functions. And this is also quite simple. You can more or less use every language. Here I'm showing an example in C. First, we have to create an export file, library.dev. And we copy it to the sqllib directory. Then we create a function, execute the function, that's it. So similar to this read function, we have here a function system call. And this system call is calling the external file OS call system call. And you grant this to public. Also here, it's a bad idea to do this. And this is the C code. And you see here the system call, system command. And here you are executing the statement. And once you installed it in the database, you can just run the system call and can do whatever you want. Hardening DB2 is much more easier in my experience than hardening Oracle because you have less public privileges. And the big difference is you are hardening more on the operating system level. So you are running special commands and then you are changing the configuration. And the DB2 CIS benchmark is quite good. So if you compare the CIS benchmark for my SQL or Oracle, the DB2 benchmark is quite good. And I would recommend to use this as a starting point. So they have a lot of good recommendations. And from my experience, from security audits, I normally recommend disable everything which is not necessary. In DB2, it's much easier because for a lot of additional functionality you need a license file and you have to pay for functionality. In Oracle, everything can be installed without additional license. That's why people often install everything. And in DB2, they normally install only what is necessary. Do not install the PLSQL if it's not needed and check the OS credentials. So in most of the cases, the biggest problem in other databases are the user credentials. So developers are lazy guys and if you have a username, they often use the same string as a password. And this is also the case in the DB2 world, but it's not a DB2 problem. It's an operating system problem. So finding credentials like DB2 Inst or DB2 Admin, DB2 Admin is not uncommon. So it really depends from the configuration of the underlying operating system. But in general, the situation is better than other systems. Okay. What are the typical steps to harden the DB2 database? You should have a look at OS credentials. You should, in the real world, you find weak OS credentials. You find that the discovery mode is enabled. The discovery mode is announcing in the network what databases are available. And just by disabling this discovery mode, you will be much more secure because it's much more difficult to find the database. What I heard in DB2.10, this discovery mode will be removed in DB2.10, version 10. Then we have too many privileges, weak default configuration, missing patches and unsecured program code. So this is more or less normal like every other database vendor. So the hardening, disable the discovery mode, change default port. So this discovery mode is disabled by using these two DB2 commands. And after doing this, it's disabled. Then you can change the port. It's also recommended in the CIS benchmark. I was never a big fan of changing the port, but if you live better with it, it's okay. Normally with a port scanner, you will find the port even if it's running on a quite strange port. Then here are some of the privileges which should be removed from public. So you can just put it into a script and run it. There are quite a few of them. Then here are some other useful parameters and you should check that you have these strong settings available. Also discovery authentication that the authentication is encrypted and so on. That's something I'm a big fan of log on trigger because the majority of database administrator doesn't matter what vendor. They have no idea who is connecting to their database. And that's why it's really important to know who is connecting from what machine with what account. Only in this case, you can limit access to the database. So you can say, okay, only from this machine, the agent account is enabled to do this. And there's a new functionality called connect proc. And with this connect proc, it's quite easy to implement a log on trigger functionality. So what we do first is to create a table and this table is storing the information about the user ID, the event and the timestamp. So you know at least who's connecting to the system. If you play with this, you should probably extend it to a few additional values. But I think for the beginning, it's quite a good idea. Then you create a start procedure and it's important that this start procedure doesn't have a parameter. So only if this start procedure runs without parameter, it works. And here we are inserting this, we are inserting in this audit table we created before the connect and the timestamp and the username. Then we update the configuration. And here it's important that we first set it to null and after it we specify the function. So the next time when we connect, we can see this connect string here in the select state in this table. And I would recommend in the beginning, look after a few hours into this table to avoid that it's filled up quite fast. And if you have a process which is connecting every few seconds to the system, you should probably add an extension and think, okay, if this special user from this IP address is connecting to the system, do not record this activity. So I see I was quite fast, faster than in my trainings, in my preparation. So at the moment, there is nearly no DB2 security resources. So if you look in the web, there are a few outdated books and there are no modules in Metasploit as far as I remember. And the majority of the security crowd is not looking at DB2. But I'm quite sure if you look at it, you will find a lot of interesting stuff. And the most interesting security bugs are at the moment published by IBM. But sooner or later, they will also realize that it's a bad idea to publish exploit code. And concerning the password problem, which is the biggest problem in other databases, like Oracle, it's not existing because DB2 delegated this problem to the operating system. But I'm aware there are also plugins where you can use a table for connecting to the database. So people migrated to Oracle concept of a username table to the DB2 world. But it's quite rare that you find this. Okay, thank you for the time. So it was quite fast. And I updated this slide a little bit, this slide deck, and you will get the updated version as PDF.


How this African country is taking over the world. Do you know that Kenya is the only African country to have produced two great world leaders in our time? Who are these decision makers? Continue watching to find out. The Republic of Kenya is a country known for its vast and diverse social heritages, producing amazing individuals who go on to become prominent leaders in fields ranging from politics to athletics. From world presidents to celebrities such as actors and philanthropists, Kenya is one of the most blessed countries in Africa. From its cultural heritage to the large ethnic groups Kenya continues to astound the world by producing world leaders as evidenced by the recent appointment of Rishi Sanak as UK Prime Minister in place of Liz Truss. Watch this video all the way to the end to learn how Kenya is the only African country that produces world leaders. Number two will astound you. Hello and welcome back to Africa Reloaded. Please subscribe to this channel before we continue. You will have access to the best and most interesting videos to watch and enjoy. Here we go. These are 14 famous people you did not know are from Kenya. 14. Malayka Firth. She is a Kenyan-born British model who moved to barking in East London when she was seven years old. Firth drew attention in 2013 when she was booked as the first black model in nearly 20 years to appear in a Prada advertising campaign following Naomi Campbell. She has warped the runway in over 45 fashion shows for designers such as Boutiga Veneta, Dolls and Gabana and many others. She has also been on the cover of British Fogue. 13. Wars and Shire. She is a British writer, poet, editor and teacher who was born in Kenya to Somali parents on 1st of August 1988 before moving to the UK when he was one. Her poems have appeared in literary publications such as Poetry, Magma and Wassery and she is regarded as one of the best poets of her generation. She has won numerous awards including Brunel University's inaugural African Poetry Prize, Young Poet Laureate for London and many others. 12. Hirun Shah. He is a Kenyan-Indian actor and a stunt double. He was born and raised in Kenya until the age of 12. According to the Guinness Book of World Records he is the world's shortest stuntman. He has appeared in the film series The Lord of the Rings and The Hobbit. Shah was born in the Kenyan capital of Nairobi. Candle Shoe was his first film. Deep Roy and Shah are both dwarf Nairobi-born Kenyan actors of Indian descent who. 11. Edie Kathiji. He was born in Nairobi Kenya on March 10 1979 and grew up in California. Edie is a Kenyan-born actor who lives in the United States. He played Dr. Jeffrey Cole, a big love, a recurring character on the television series House, she's in the 2007 film Gone Baby Gown and Darwin in X-Men. First class, Edie also appeared as Baron Jacobi in the AMC series Into the Badlands as well as in a number of other fantastic films. 10. Roger Wittaker. Roger Henry Bro Wittaker, born in Nairobi to English parents, is a British singer-songwriter and musician. He is the man behind the song My Land is Kenya, that beauty of Kenya with a dreamy baritone voice. In his long career, Roger has amassed over 250 silver, gold and platinum albums garnering fans from all over the world. His distinctive whistling ability sets him apart from other artists. 9. Chada Gorinda. She was born in Kenya and immigrated to the United Kingdom with her parents in 1961. She was raised in Southall, London and attended the University of East Anglia. She began her career as a BBC radio journalist. She has directed several award-winning BBC documentaries. She formed a partnership with the British Film Institute and Channel 4. Chada founded Umbi Films in 1990, despite having no formal film training. 8. Maafai Wangari. Wangari Muta Maafai was the first African woman to win the Nobel Peace Prize and she is a Kenyan social, environmental and political activist. She is internationally recognized for her unwavering commitment to democracy, human rights and environmental preservation. She has addressed the United Nations on several occasions, including a special session of the General Assembly for the five-year review of the Earth Summit. 7. Marigam Damod. McDonald Marigawanyama is a retired Kenyan footballer who played defensive midfield. On March 16, 2010, Marigawanyama became the first Kenyan footballer to play in the UEFA Champions League for Internationale. After Ken Okoth's death in 2019, he entered politics to run for the Kaibara parliamentary seat. 6. Wanyama Victor. Victor Mugubi Wanyama is a Kenyan professional footballer who left Tottenham Hotspur to play as a defensive midfielder for major league soccer club CF Montreal. On November 7, 2012, Wanyama became the first Kenyan player to score in the UEFA Champions League when he scored the opening goal in Celtics 2-1 win over Barcelona. 5. Leakey Richard. He was a Kenyan paleoanthropologist, conservationist and politician who lived from December 19, 1944 to January 2, 2022. Leakey held a number of official positions in Kenya, mostly in archaeology and wildlife conservation institutions. He was the director of the Kenyan National Museum, the founder of the NGO Wildlife Direct and the chairman of the Kenyan Wildlife Service. Before we continue, please leave your thoughts in the comments section. 4. Kipchoch Eliot. Iliud Kipchoch, born on November 5, 1984, is a Kenyan marathon runner who previously specialised in the 5000m distance. He is widely regarded as the greatest marathon runner of all time, having won the 2016 and 2020 Olympic marathons and holding the marathon world record with a time of 2 hours 1 minute and 9 seconds set at the 2022 Berlin Marathon. He's completed 4 of the top 5 fastest marathons in history. In 2003, Kipchoch won his first individual world championship title when he won the junior race at the World Cross Country Championships. 3. Barack Obama. Yes, former US President, Barack Obama is of Kenyan descent. Barack Hussein Obama is an American politician who served as the United States 44th President from 2009 to 2017. He was the first African American President of the United States and a member of the Democratic Party. He was born in Kenya to a Kenyan mother and an American father. 2. Sunak Rishi. Another surprise, right, Rishi Simech is a British politician who in October 2022 was elected Prime Minister of the United Kingdom and leader of the Conservative Party. Sunak was Chancellor of the Exchequer from 2020 to 2022 and Chief Secretary to the Treasury from 2019 to 2020 and he has been a member of the Richmond constituency since 2015. His father was born and raised in the Kenyan protectorate which is now Kenya and his mother was born in Tanganaka which later became Tanzania. His ancestor was born in India. Sunak's parents immigrated to the United Kingdom in the 1960s. 1. Lupita Nyong'o. She is a Kenyan-Mexican actress born on the first of March 1983. She has received numerous honors including an Academy Award and nominations for two Primetime Emmy Awards and a Termi Award. She was born in Mexico City to Kenyan politician Peter and Yang Nyong'o where he was teaching and raised in Kenya since the age of three. She later worked as a production assistant in Hollywood. She made her acting debut in 2008 with the short film East River, Black Panther and others. Kenya undoubtedly takes pride in being the only African country to produce such great leaders. Thank you for sticking with me until the end. Remember to like, share, comment and subscribe to our channel if you want to see more videos.


Welcome, everyone, to theCUBE Virtual. I am your host, Rebecca Knight. Today we are talking about cybersecurity and healthcare. Our guest is Ken Checkai. He is a problem solver at Netscout. Thanks so much for coming on the show, Ken. Oh, my pleasure. Thank you for having me. I love your job title, a problem solver. Tell our viewers a little bit about Netscout and about your role there. Sure, no, I appreciate that. Yeah, Netscout's been around since 1984 and the gentlemen starter company, two gentlemen starter company, Anil Singhal is still our CEO. He's very passionate about what we do, believes in what we do, and our focus really is really service triage and making sure that important customer services and none more important than healthcare are up and running and functional. And so our focus is really protecting and where we call ourselves guardians of the connected world. We take that very seriously because when you think about the technology, the complexity and how we all really, the reliance on everything that we do and how we rely on technology as a just a society, our focus is protecting that. So the applications, the services, the network, that's all part of the service chain for that. Well, we know that healthcare organizations and hospitals are under tremendous strain and pressure because of the COVID-19 pandemic, but also recently hospitals all over the country have been hit and targeted in a scourge of ransomware attacks. Can you tell our viewers a little bit about what you're seeing and what's happening right now? Oh, yes, it's really sad. It's just an interesting time in the world, obviously, but we are seeing a very heavy increase in the number of attacks and from a cybersecurity perspective, really an extortion and ransomware. And there's a slight difference between the two, but effectively what's happening, we'll call them the bad guys, are going after healthcare organizations that have some vulnerabilities where they have some areas where they can be attacked. And effectively what happens is they will either launch a denial of service attack, which is really a lot of robot type computers launching just directed attacks at these particular caregiving organizations and hospitals. And then so they try to take down services. And that's one thing. So that's really more of a ransomware where they, hey, we showed you, we can do it. Now we're gonna extort money from you until you pay. The other one is more of a ransomware where they've already penetrated what we'll call the defenses of the hospital.  Both we're seeing lots of attacks in that realm. So what is the upshot in terms of patient care?  What are patients seeing? What are doctors seeing? Well, it's a really good point, especially in today's world with the pandemic, but really anytime for healthcare. We all have children, aunts, uncles, moms, dads. Nobody wants to be in the hospital for extended periods of time. And when they're in the hospital, we wanna make sure that from a healthcare organization, they wanna make sure they give the best care possible. And the caregiver, so the nurse, the doctor has the opportunity to do what they do and focus on what they're caregiving and not on the technology. So when things like ransomware or extortion or any particular impact on performance for a particular application, it just impacts the caregiver, which is, you know, and it affects us because these are people that you care about. You don't want them in the hospital. You don't want them in pain. And the caregivers, they're, you know, these are passionate people that do what they do. Obviously they're dedicated to it. So when there's an impact from a cybersecurity perspective or a application or a network issue that affects healthcare, that affects our loved ones.  We, especially at Nutscout, we like to, we partner with our customers. So, and we don't take that lightly. That's something that we mean and it's heartfelt. And the reason for that is we look at ourselves an extension of their team. This is what healthcare organizations offer to their patients and they're there for care to get well. We wanna make sure they have every opportunity to do that and because those healthcare organizations rely so much on technology, networks, applications and really protection from bad guys in cybersecurity. We just wanna make sure that those services are assured. And that's why that's where our focus is. So this, I mean, there are lives in the balance as you're describing. This is a technical challenge, but it's also one of resources. A lot of these organizations just simply do not have the resources to deal with these problems effectively. Great point. That's a great point. I mean, especially in today's world, the actual industry for healthcare is really taking a beating because it really had to focus their whole, all of their funds, frankly and all of their resources towards the pandemic, which would be personal equipment, mobile hospitals. And that's taken a tremendous toll and they've also from just a revenue perspective of really taking a beating, frankly on what happens from their revenue cycles because elective surgeries are way down. So when you start looking at, you take that into consideration. So they've got very, very tight resources and cybersecurity in general is just a thankless job. They're under attack every single day, no matter what their industry is. So when you look at the current situation, you get tight resources, cybersecurity is under a lot of stress and oh, by the way, here come the ransomware and extortion attacks. It's just a, it's terrible what's going on, but this is an area where we feel this is a spot where we can really help. Number one, our focus is really on network and service assurance. So the applications in the network and that's what we're very good at and been doing it for many years. But the upside and the place where we really feel we can help is really two-fold. And that is that same solution, the same deployment that we have for a network and application really can be leveraged by cybersecurity folks as well, mainly towards the areas of denial of service, mainly towards the areas of voice over IP. We think of telecommunications and telemedicine, that's all being leveraged and heavily leveraged right now, specifically by healthcare organizations. Well, again, if I'm a bad guy and I know you're trying to use your telemedicine to take care of your patients and have that interaction with the doctor and the patient and I take those services down, well, now I've impacted patient care. That all runs over unified communications protocols, voice and video, things that we can monitor, not only for performance, but also when we see cyber type issues and that's a really big, I would call it a bit of a hole at the moment, because that's a spot where cybersecurity teams are so strapped, so resource strapped as well from what they're trying to deal with every day. That's a spot we can help with and help with immediately. And as I mentioned, the other part is really the denial of service pieces, which is, that's part of what we do as part of our framework of what we deliver for services. So you're describing an exceedingly complex caregiver chain on so many different levels in terms of cybersecurity, in terms of telemedicine. And you also said that NetScout really partners with its clients. Talk a little bit about NetScout solution and how it helps clients and or healthcare organizations grapple with these challenges. No, that's a great question. Well, the one thing right off the bat is we look at network traffic and that means application traffic. So while we plug in on a network and take traffic from taps and spans and whatnot, we take traffic into our appliances so that we can, then we crunch that data through our smart data. So we call it depth of service intelligence. That's our patent. And we run it through that engine and that creates smart data. And that smart data then can be leveraged for, gee, is my problem with my network? Is my problem with my application? Is it something like a service enabler, like DNS or DHCP or LDAP, which is really the basic building life for active directory for authentication. So when you look at a complex, as you mentioned, a complex chain, an electronic medical records application, an EMR, that's really the go-to application for a hospital because that's scheduling, that's billing, that's diagnosis, that's history, that's patient history. It's just so integral to what they do. And when there's an impact with that, that affects patient care. And no one ever wants to hear, oh my goodness, we had a bad outcome with a patient because of a computer glitch, network application we had. And so what we do is the ability to take all that data in, crunch it through our engine and then display that in dashboards that are very easily consumable by not just network people, but really application, even management, cybersecurity, unified communications folks. And the focus here is we wanna get the problem set. We know there are gonna be problems. It happens every day and networks and applications are complex. The idea is when we have an issue like that, let's get the problem to the right team so that it can then go through their service restoration process. And again, the whole point here is keep services up and running. But the challenge becomes in a complex application team set up where you've got DNS, DHCP, LDAP, RADIAS. So you've got service enablers, then you've got web servers, application server, database servers, load balancers, firewalls. When somebody says, oh my goodness, the EMR is down or we're having issues with our network, that's a very tough chain to try and pinpoint. It's almost needle on a haystack. So what we do, and this is kind of our Bailey work in the world, is really we take all of that different traffic and we expose where are the hotspots? Where is the latency? Where are the error codes? Where do we see protocols that aren't behaving well? What are we seeing things that are, we're seeing authentication failures. And the big win for the healthcare organization on that standpoint is I can see all of my traffic, all of my applications and then I can pinpoint where I'm having issues so that I can restore services very quickly. What are some of the best practices that have emerged in terms of the company, in terms of the organizations and hospitals that are doing this well? What would you say that they're doing right? One thing, they want to partner. So they recognize the fact that number one, they've got limited staff and they actually want to partner with that scout. And what that means is we actually go in and we'll design solutions that will address their specific requirements. That's very important to what we do. But when we do so, we take, we have different product sets but our finish stream, our finish stream next generation ISNG is our data collector. And that's really the workhorse of our solution that processes all the packets from we'll get technical here for a second, but one gig to 100 gig. And that's a lot of data to process. And because we can just get to the point with the process to the smart data engine and get to the problem to show me where my latency is, show where my problems are, showing my protocols, pulling that up through our packet flow switch engine which kind of facilitates us collecting for multiple hops of the network. A lot of times IT folks will ask us, well, we want hop to hop views of this. And like, great, let's do that. We can do it right now. We just need to sit down, design it. But we really design towards their use cases and in healthcare. It's very common, you're gonna have DMZs, you're gonna have people accessing their electronic medical records to their DMZ and things like that. And as it goes through the back end services, we basically taking a traffic feed from all those different hops of the network work and cases that make the most sense, the primary spot and choke points and then take that data in and then we do what we do. We expose the data and expose the performance information and most customers and it's like this in the world. People usually don't call you up to say, hey, Rebecca, you're doing a great job today. I want to buy you a cup of coffee. Especially in IT, they call up to say, hey, things aren't working. Hey, fix it. Hey, I can't do something. And so our job is to help facilitate with those customers and really partner with them to design solutions so that they can not only view that information but also triage it really quick. And the word triage makes a great deal of sense in healthcare. For example, if you hurt your finger, they're not going to take an X-ray of your foot. Makes no sense because they've already triaged that that's not your problem. We do the same thing, but we do it more from the network and application side to see where the hotspots are. You are the IT triage. So talk a little bit about this, you are a problem solver. And so right now we have a crisis on our hands of monumental proportions. Do you think that it has forced healthcare organizations and hospitals to innovate more quickly at this time? Or do you think that there is still just so much uncertainty taking place right now that it is hard to see the forest for the trees? What are you seeing? That's a really good question. We're seeing both, just to put it just very, so one of the biggest changes that really the pandemic's had on everybody is the switch to everybody went from, I have 10, maybe 20% of my workers working remotely or VPN contractors, things like people that are just can't be in the office for a reason, they switched from 10 to 20% to 70, 80, 90%. So it was an overnight change. So think of the impact on that. The caregivers are at the hospital, they're actually the frontline workers, they're at the hospital serving their patients. But people in the administration, accounting, IT, other things that are important to the organization all had to switch to work from home, obviously for safety reasons. So the impact on just the internet link number one, huge impact before it was used for outbound. Hey, I'm gonna go check, I'm gonna go do some research, I'm gonna go check a website, I'm gonna see what sports activity is going on today. Now all the tribe is coming inbound on the internet. So that's number one, number two, big change VPNs. VPNs took an enormous beating that maybe they were sized for that type of scalability overnight and maybe they weren't. So the organizations that were kind of prepped for it, not such a big change and we've seen some good results from that, but there are also organizations that immediately had to switch to, oh my goodness, I need to upgrade my VPNs and my internet links because I wasn't prepared for this. So the larger organizations sometimes have a little more capabilities to make that change quick, the smaller organizations, that's a tough call. So they really have had to innovate quite a bit on that side of it. But when you add that stress on things that also shows that the internet and the VPN is really points where the bad guys are gonna target which again, we're starting to see that in the ransomware and the extortion attacks. So it has forced innovation certainly, but you bring it to the point of forced to the trees. There's still a lot of work to be done. So that's where we're really putting a lot of our focus, especially in healthcare right now because it's got the biggest impact, well, frankly, to society right now and it'll just the companies. So as company, as other organizations are navigating this period of new normal and of course we've had some positive vaccine news. So we can say that perhaps there is going to be an end to this pandemic in the coming year, but how are they planning ahead? I want you to close us out here with how healthcare organizations are thinking about the next 12 to 24 months. And if you have any advice for them, I'm sure they would be all ears. Yeah, I think we could all use some good advice right now on that one. Short answer is, I don't know either. Right now in healthcare, it is a big challenge because of the, as I mentioned earlier, the impact on the personal protection equipment, mobile hospitals, and frankly where they've had in the revenue loss. So it's become a, you basically have to do more with less right now, which is one of the things that we do. And really, it's kind of our message for customers anyway. I'm a big proponent of use what we have. If you have our solution, use what you have and use it to its full extent, especially while times are lean, we just don't, the wallets aren't as big right now. So we're going to have to really focus yet.  I can't think of one. So our focus right now in our message to our customers and anyone else is if you've got our types of solution, use it to its fullest capability so that you can triage and so that you can, not have patient impacting issues on top of all the other things you have to deal with. The, bring up the point about the vaccines. One of the things that we've seen, especially for what's called healthcare organizations that are more research focused is the bad guys aren't very nice. So the bad guys are going to go after organizations where they can have a big, we'll call it splash, or they can steal something. So the research hospitals that are working on vaccines or something in that realm have been huge targets, again, DDoS for ransomware and extortion. My message for anyone in healthcare right now is, you know, bless you first of all and second of all, use what you have to its fullest extent, which means a solution like ours. Yes, use it for network monitoring, use it for application monitoring, but please use it to protect yourself for cybersecurity type visibility. We typically in a lot of cases, we'll see traffic that some cybersecurity tools don't and not because they're bad tools, but because we're installed in places that they sometimes aren't. So that might be where they're typically installed maybe on the perimeters of network and endpoints. We actually are instrumented through that service chain. So not only the outbound internet, the wide area network links, the VPNs and DMZs and VDI and all those acronyms that are thrown out. Those are typical spots for us, as well as though virtualization, to be cloud or private cloud. So effectively we have areas of visibility that can be leveraged in bigger and better ways, even really on the cybersecurity and unified communication sides of the fence. So my message would be to be just use what you have to its fullest capability, especially while times are lean and keep up the good fight. Excellent, leverage what you got. Ken Check-Eye, Problem Solver at Netscout. Thank you so much for coming on theCUBE. Thank you for having me, it's been a pleasure. I'm Rebecca Knight, stay tuned for more of theCUBE Virtual.