As I mentioned, thank you very much for joining, particularly my pleasure to talk today with Mary Stevens. Mary is a friend of MIT in general, and in particular by now. She is the Worldwide Vice President supply chain of consumer health and delivery at Johnson & Johnson. I'm Professor Sheffi, I'm Director of the MIT Center for Transportation Logistics. And today we'll talk about lesson learned during COVID-19 and a look at the future of global operation, vaccine rollout, the role of resilience, and leadership. So Mary, thank you very much for joining us. Thanks, Sheffi. Yes, it's really a pleasure to be here and to share with you. It's going to be a great, great couple of minutes and time to share about what we're doing at Johnson & Johnson. Sure. Johnson & Johnson, of course, is now in the North. So this was all our design. We wanted to do it just after Johnson & Johnson started rollout in the United States. I'm kidding, of course, this was said a month ago. But the question is still, how is the vaccine rollout going? Is this something that you can tell us something about? Well, thanks so much, Yossi. I mean, we are really pleased with having received the emergency use authorization at the end of February and being able to supply our first doses of the vaccine and more to come. As our CEO has committed, we're expecting to ship about 100 million doses before the end of the second quarter. And the ramp up is just tremendous. Working all around the world with colleagues and manufacturing sites and building distribution centers. And we're really pleased with where we are right now. It really, you and I, we're talking just beforehand. It really is a miracle to have come this far. And I'll quote our CEO in saying from essentially 13 months ago in January, having an unknown virus and really coming all this way to discovering of the molecule, starting up manufacturing, getting the emergency use authorization, and then beginning to ship within 13 months is nothing short of amazing. And so with people working around the clock in all of our functions across the business, it really has been a collaborative effort with us, with partners, with everyone. And we're really, really pleased. I'd like to be very excited to help. I'd like to build on this because clearly at the beginning, your scientists were working around the clock. In February, March, I'm sure it was all science experiments and discovery operation. But soon thereafter, it became a big supply chain challenge. So can you tell us a little bit about the atmosphere within J&J and your function, the supply chain and manufacturing and distribution, the whole delivery cost? How are people working? You just mentioned that you are starting your Zoom call at 6 AM and finishing it. A little busy. But how is the atmosphere at J&J? I would say more than anything else at J&J. We are focused. But the pandemic has done for us more than anything else is created this laser focus on what's crucially important. When I reflect on our credo, it always starts with the patient. And the first word, say, we have a responsibility. And so for everyone all across the enterprise, it's not a question of, oh, this is my job or not my job. What strikes me about J&J is that we are truly built for times like these. And with the crisis, no one says no.  And so while initially it was very much about the science and really discovery, but as you said, very quickly, we were having to create whole supply chains that didn't exist before. And so whether it was manufacturing or distribution or warehousing, these are things that weren't in existence a year ago. And so the parallel pathing of activities because of the great collaboration that we have allowed us to get to where we are now in a much faster way. But it also required all of us to work differently. And so we talk about how do we identify talent in a crisis and who can step up? And that's where for me personally through this, it has been the most exciting thing to encounter people. I probably never would have encountered before because they've stepped up and there are meetings where you have just multi-layers in the organization, everybody working together, you can't really tell what title anyone has or what role they had before they stepped in because everyone is so focused on the work to be done. Sounds like the military when they're on the fire. You know, everybody, it doesn't matter what your rank is, as long as you get shot straight and help your comrades. But can you extend this to your work with suppliers? How did this work change? Who stepped up? Who did not? Not who. Yeah, and look, I think one of the things that I hope will continue long after the pandemic ends is this newfound era of collaboration. And so I think for me, and just thinking from the logistics and distribution side, what we've been able to do with our critical partners throughout the pandemic has been amazing. So we think about what started for us in logistics and distribution is the starting problem, right? Which was things in China started to shut down. Roads were closed. Every province was doing something different. And so really working with our partners in transportation, aircraft was shut down, where we had flights that were canceled because a lot of our product was riding in the belly of commercial aircraft. And so you had to work very closely, almost at the minute, to make sure that loads were picked up and things were changing and really being able to drive decision making. And you could never have done that without clear collaboration, senior partnerships that had to have happened before the pandemic struck. So in the middle of the pandemic was not the time to create partnerships. It was to leverage partnerships. But I feel like our working relationship is so much different than it was before, because we're talking more frequently, we're creating solutions differently, and we're working together in order to really be able to meet the needs. Because it's not only about vaccines for us, right? And we have a huge business. We have to be able to supply patients of all types with critical medications and critical needs. And so it really doesn't matter. But at the end of the day, that it is one product over another, it's really being able to meet the critical needs of our patients. And you think this type of communications, relationship, reliance on each other will continue going forward? I certainly hope so. I think it really has, there's nothing like a good crisis to really be able to break through barriers in a way that maybe you couldn't do before. And so really the openness, even if you think about what happened just recently announced by President Biden between Merck and Johnson and Johnson and the collaboration that is founded, these are things that typically would not happen. But I hope that the open dialogue, the open collaboration changes the way we all work going forward, because that will help us really meet the needs of our patients and also reduce the cost of health care in the long run. Sounds good. I certainly all hope that you are right. Given J&J, in your experience during the pandemic, what was the biggest insights as far in terms of supply chain or the more also the biggest challenge in the supply chain leader? Can you think back? Yeah, so I think right from the start, what has impressed me the most is our resilience and our ability to drive agility. So if one route closed, then another one would open. And so the combination of people really being able to drive rapid decision making and then also really being able to focus and prioritize, these were the things that have helped us be most successful. And so we thought we were resilient and we proved that we were resilient because our supply chain held up extremely well throughout this pandemic. We've really done, while we've been able to move and change and evolve, but also really be able to meet the needs. And that was a critical element of how we had designed our supply chain from the beginning, but then also the way it performed all throughout the pandemic. And now as hopefully we're beginning to see the light at the end of this tunnel, we're really hoping that we can be in a different place. And I'll just give you one example. At 1.98% of our customer service people pivoted from working in call centers to working from home. And that's a big shift for us, really being able to work differently, use technology that most people were not as, clear resume was not a thing a year ago. And I think most of us have gotten much more technically savvy, but we've also been able to leverage our investments in digital that allow us to have the flexibility to be able to pivot those teams from home. And then the other piece that's so exciting is that the embracing of digital, the curve and maturity has accelerated tremendously where before people were more resistant, now people are required because there's no other way to get it done. So just a big shift in the way we're thinking and the way we're working. Sure. Just a quick question from the chat. Larry Tillam asked about the recent, I don't know if you can answer it, the recent announcement of the external manufacturing with Merck, who will Jen Deliver on the logistics? Who will on the logistics to make sure that to ensure the integrity of the supply chain? So, you know, and I am not as close to the details of the relationships with Merck and probably wouldn't be able to talk about it anyway, but the thing to note is what we work on with all of our collaborators in this process. I mean, we have many, many partners is that we work through the quality requirements, the process, the tech transfers and the needs, whether it's logistics and distribution or it's manufacturing, we have critical quality requirements, we have critical processes, and then we work with our partners to perform. And so within any element of that performance, we expect that partner to perform to the specifications and of course we help them through that process, through support, through people on site in order to make sure that everything meets the expectations of our critical quality requirements. In general, let me just move to another subject. In general, always say that before January 2020, when people ask my wife what's your husband doing at MIT, she said supply chain and people just look at her like deer in the headlight. Now, my husband does research in supply chain management. Oh, that's important. Now everybody, what was the impact on the supply chain function within J&J? So within J&J, supply chain has always had a seat at the table. Kathy Wengel sits on the executive committee. It's always been a critical element of what we've done, but I would say that maybe we didn't spend as much time in some of the leadership team meetings talking about supply chain. I think it's been a critical element. Now everyone is involved at a granular level of understanding of how we work and what we do and its results in crisis management. The executive committee has been meeting almost daily with crisis management and conversations in order to make sure that decision making can be made quickly. And I think that's the big change where supply chain was always important, huge investment in supply chain, very important as far as how the seat at the table was, but during the crisis, the time to decision making needed to be short. And so the conversations around decisions with regard to this supply chain were very much impacted by everyone. So you wanted to be able to make those decisions quickly. And so those conversations around supply chain were happening at every table, almost every day. And so those are the kinds of things that shifted not level of importance, not level of interest, not level of the leadership caliber, but how often those conversations were part of the conversation at the executive level every day, I think that has shifted a little bit. Mary, let's talk to you, allow me a little more personal, not too much about your leadership style. Did it affect your leadership style going through this experience? So I think it's not so much style, but as much how I spend my time. And so where in the role that I play, maybe a bigger portion of it was strategic and less of it was tactical. I said to someone at one point, I treated the entire world like a poor performing factory at one point. We were having warm room discussions twice a day. How do we think about this constant communication really being able to do it? Similar to the way we talked about the executive committee leaning in because the time to decision making needed to be smaller, we needed to be able to focus and prioritize effectively, which meant that everyone at every level of the organization needed access to decision making quickly. In order to be able to get that decision making quickly, we created forums that were different. And so more tactical sessions, more frequently. And then as things settled down, you spread the time between those tactical sessions, but the intensity hasn't stopped. And so really being able to work remotely is opposed to walking factory floors and doing things and really being able to access information quickly and make decisions quickly. I think what I would say is that more recently, we've been more tactical as leaders than strategic, but that enables us to drive those decisions more quickly. And then the other thing that I would say is that for me personally, I think a lot of us were talking about Zoom. We have a lot of very short bursts of Zoom calls with a lot of different people. And that has pluses and minuses, right? But I think there's no substitute for getting to know people upfront, personal, walking factory floors, walking distribution center floors, going out to dinner, really meeting people. But Zoom allows you an intimacy, like you're almost inviting people into your home. That's a little different than what you expect. So you get a somewhat different relationship with people. And then I think the other thing that is critically important is making sure that you're keeping an eye on your team. Because what I have found, especially as we've hit that one year mark for people over the last couple of months, that there's an exhaustion factor. And just making sure that you're giving people permission to take some time to regroup. Because without it, and you have to lead by example, you have to, without it, people just hit the wall and people are tired and they're not their best. And so you need to be able to show people that it's okay to take a break, that it's okay to be able to step back and that you're keeping an eye on people to make sure they are taking that time when you feel like maybe they're a little too stressed and giving them some support. So it's that balance. There's a lot of questions in the Q&A about resilience. People were, several people were sending kudos about how resilient the fact that Johnson and Johnson was resilient and you were able to keep the product flow basically. But people ask if you have your own definition of resilience, what metric you use to measure resilience if there are any specific metrics. Well, you know, I mean, the number one measure of resilience for me on the product side is the product available when somebody wants it and needs it, right? That's the number one definition is reliability. Is are you reliable? But on the leadership side, I think there's a different definition of resilience. I think resilience is demonstrated by this can-do attitude. And so you have to be able to lead with a clarity, focus, and positive impact that allows people to be successful. And so, you know, you have both, right? You have this, you must have reliability, you must have product. And under incredibly constrained situations that can put a lot of pressure on people. But from a leadership perspective, it's crucially important that you also lead with the ability to tell people that you know they can get there. And it's really not so much about, you know, just constantly, what are you doing? What are you doing? What are you doing? And, you know, our China leader tells a story and I'll go back and said, look, we had our first emergency crisis management call in China on January 27th last year. And she said, she'll never forget it. She said, you know, Mary, what you said to me is, I am so sorry for taking your valuable time. What can I do to help? Not what are you doing? What are you doing? What are you doing? But how can we help you be successful? And I think as leaders, that's our responsibility. It's not always to be demanding, but also to roll up our sleeves, especially when people are very overwhelmed and understand what we can do to help them to succeed. Because failure is clearly not an option. And we had to be agile. We had to try things. Some things didn't work. We had to adapt and really be able to take pressure off so that, you know, they can be doing their work to be successful and be that buffer. And so that's a big piece of the way I think about resilience. Thank you. You know, I wrote several books on the subject and I always mentioned that the culture, which is really what you're talking about in leadership culture, is the most important ingredient in building logistics. Because people look at the physical metrics and miss exactly what you just said. I have lots of questions in the Q&A. One of them, you may, I don't know if you have the right one to answer, but several people are asking that. And Chris from Cambridge is asking, talking about it seems that the back end of the supply chain for vaccine, the sourcing manufacturing part of distribution went exceptionally well, but the final distribution from the state to the arms still has problems. And we live in Massachusetts, which is an example of how things can go wrong and how, you know, good government stumbles. And then they do stumbles. Are there any recommendations from J&J on how this could be done better in the future? Yeah, I think we all have opinions. And I live in Pennsylvania, which is no better than Massachusetts. If anything, it's worse. So I would say that, you know, from a Johnson & Johnson perspective, and I'm sure if we were talking to my peers at Pfizer and Moderna and other places, what we would say is that we are not, not part of that part of the process. And so, and we all probably have ideas on what we would do differently if we were sitting in those chairs, but it's really hard for me to put myself on the other side of that fence, because I'm really just unclear as to how those governments work and how those rollouts have happened. I mean, clearly, if you look at the outcomes, I think what some of the states have done by managing centrally with some simplicity and simple websites has gone better than what, you know, I would say in Pennsylvania, we're going county by county and it is less than satisfactory, I think, for everyone. So it's just, you know, I think clearly there's opportunity, but from my perspective, it's hard for me to say because I don't understand kind of what happens on the other side of the fence. And, you know, I think to a certain extent, what we've all had to do is said, okay, this is my piece. This is what I'm focused on and I'm going to do this piece to the best of my ability and hope and pray that those people to the left of me and to the right of me are also able to focus and get their piece done because that's the only way we've been able to, you know, remain clear on what the outcome needs to be. Fair enough. You mentioned the fact that you had the ramp up of digital infrastructure, digital tools. Several of the questions, I think four or five of them are focusing on visibility. Did you invest in visibility? Did you get better visibility to what was the role that visibility played in your success, in fact, in your supply chain success? Yeah, we've been in a multi-year journey to invest in digital. It's one of the things that has been the hallmark of our transformation over the last five or six years is really heavily investing in digital. And so, you know, the way we think about digital is really in two distinct pieces. The first one is thinking about the whole, you know, consumer to cash cycle, which is, you know, what consumer insights do you have? What do you think about from an ordering process? What do you think about from, you know, an order tracking and then all the way through invoicing and cash, right? That's one section of our digital thread. And the second one is on the physical side where we've been looking at transparency starting at the patient or the consumer and going all the way back through our supply chain back to raw materials. And this is, and then by having both these pieces of visibility and this transactional improvements in investments and digital and capability, then that allows our planning engines to work most effectively. And so that's no different when it came to vaccines or anything else. We've been working all the way from sensing the physical product from one end to the next and we have had huge investments over the last number of years in that area. And that's all in our process controls and everything else in addition to the transparency itself. And then also in our order to cash process in order to be able to drive this ability to see. Because if you don't know where things are, it's really hard to tell. And especially on things like our farm products where temperature gradient is so important, really being able to monitor real time our products in flight and where they are and how it helps us to make sure that we aren't going to have temperature gradients across the kind of the flight path, if you will of the product from one end to the next. And so while our product is a little simpler because it doesn't have to move around the country at extreme temperatures, it still needs to be maintained at a consistent and appropriate temperature and we need to monitor that. And so all the technology that has come into play now where you can have full-time temperature monitoring and the sensors keep being developed and it's really exciting what's happened and being able to flag when we've got problems so we can remediate quickly. Mary, you mentioned the effort to digitize. Some of the questions on the Q&A and I'm not going to in particular I'm trying to somewhere and several of them. One is looking at the, did you learn, can you talk somewhat about process that you found out that certain processes work better? Sure you did. Because you work, there was a burning platform so everybody is working together but it will be over or so we hope. And the question is, did you learn anything about revamping your processes? Doing processes is better. As distinct from sometimes there will be supported by digital technology, sometimes not. Can you talk a little bit about process improvements? Absolutely, we are constantly in the process of adapting and modifying our processes through innovation. We're always scouting for new ways of working in order to be able to, I always refer to it as stealing with pride. Really be able to benchmark, to look, especially to other industries that might have things that they've tried and been able to do and adapt. And so that's part of our culture is to constantly look at what we're doing and adapt and improve our processes so that we can be better the next time around. What I would say about the crisis and the pandemic which we worked hard not to waste is that it's accelerated some of the adoption of some of the changes we really want to be able to do to go forward. So you think about it in terms of things that might have been in an experimental phase and a test and learn phase have quickly gone to scale because of need. So one example I'll give you is being able to look at order patterns. So one of the things that we've been doing is a lot of work around automating and doing a lot of AI and investigation into our order patterns. So we wanna look for anomalies, things that are not supposed to be happening. And so we have been more experimenting with that. But I think as we all knew in the beginning of the pandemic, there were all these rumors, oh, this drug will work or that drug will work or that drug will work over here. And that created ordering patterns that were out of the norm.  So we had to be real time scaling our ability to look at those order patterns so we could identify those quickly. And now that we've done that, we'll never go backwards. So we'll be able to sense when ordering patterns are happening that are not normal so that we'll be able to deal with that in a much more real time basis. And that's an example of how we've been able to take something that was in its infancy, really test it. Now we have way more data. We have way more examples of where things were kind of crazy. And so you can really take those things and be able to demonstrate the efficacy of being able to use these tools in a different way. Thank you. Now I'll ask you a more strategic question, which there's a lot of interest both in the Q and A and then I had this question before, the idea of localizing production and localizing procurement, in fact, to the extent possible. Governments around the world, it's not only the Biden by America, it's by British, by French. It's all around the world, Chinese for sure. How is this impacting a global company, multinational like Johnson and Johnson that makes and sells around the globe? How does Johnson and Johnson think about it strategically? So the buy local for local push and to shorten supply lines was not something new from the pandemic. I think the political environment has gotten much more focused on this activity but really being able to understand our supply chains, the length of our supply chains and where we cite manufacturing is something we've been doing for a long time. During the pandemic, what we found is that our supply chains worked really well. The balance that we have around the globe was very good and we actually had very few areas other than a few odd constraints like things like alcohol. When everybody's making hand sanitizer and wipes, those kinds of supply lines which had been prevalent and just everywhere before were more constrained but I think that generally the supply lines worked extremely well. And so we're not rushing to say, oh, well now we're gonna move everything from A to B because A, that's expensive and B, that takes time that may change with the product flow. And so what we continue to do is look at our supply lines for number one, reliability and resilience. Number two is are they cited correctly in order to be able to serve our consumers and patients correctly at a great price and really being able to do things in the most efficient and effective way so that we can always supply but then we'll also continuously evaluate the national norms that are going on to see whether or not we have to rebalance. And so it's hard to just make a jerky response when you're operating a supply line which is constrained by regulatory and approvals and other investments that need to be required in order to be able to make products at scale. And so really it is about, how do we think about partnerships? How do we think about leveraging sources of supply but also really continuously balancing our supply lines to serve the world in the most effective way? Thank you, Mary. As I mentioned at the beginning, there are many, many students on the call from all around the world in addition to a lot of professionals but the question from one of the students, I assume it's one of the students, considering the lesson learned from the pandemic and its consequences, what new skill would supply chain talent acquire in order to become ready for the new normal? So it's the same answer that I've had for the last three years. We're a geeky bunch in supply chain. We're very technical. So the same skills, data sciences, analysis, analytics that have served supply chain leaders well for a long time, the hard sciences, engineering, those are the kinds of things in supply chain that really work well. Those people who are STEM focused really do most effectively in our supply chain but I think it also helps from a personality perspective is we talked about resilience before but you also have to be a little bit able to take the punches, right? So in supply chain, we're on the dark side. We don't really have wins. We only have lack of loss because the best you can do is to be 100% on time with perfect quality at zero cost. And since that never happens, you tend to always be on the negative side of the equation. So you have to be able to take that and be very resilient from a personality perspective or unless you tend to be a little disappointed all the time. It's all about getting up off the floor after getting punched in order to be successful because you don't have these great big wins. So it's really about how are you able to problem solve, deal with thousands of problems all the time and multitask and be able to do it from a personality perspective. But then it's very much about that technical side, that deep science, that math and those analytics that make the difference. Yeah, interesting being able to pick yourself up from the, it's really interesting because a lot of supply chain adopted cost avoidance basically as a metric of success. It could have been worse. And it looked like you guys can use it in Spain because you kept working while others did not. So it's a, it could have been a lot worse for J&J without the preparation, the investment supply chain, the J&J. Lots of questions about them. Really lots of questions. That's good. That means people like the conversation. They're going too fast for me and then too many of them but it's great. Just put one, jumps up during operation war speed, various leaders have made both statements proposing aggressive delivery timeline. How has J&J been able to manage expectation with customer and suppliers given or given all the uncertainties? Look, we're data driven. We are completely data driven. We focus on science, we focus on facts and we tell people what we know. So it's really just about, you know, you can only tell people what you know and be based in facts and information. And you know, I'm not a big believer in over promising because I think that always goes badly. I'd much rather be clear based on data, tell people what we know. And then if we do better than that, great. But I hate it when we have these perfect timelines where you say, oh, this is the best case scenario and that's what gets committed because the world doesn't really work that way. Things tend to go wrong. Things tend to not work exactly the way we expect. And so when you over promise, then people get so disappointed and it's so much better when we give people good data-based, science-based information. And then if we do a little better, fantastic. Everybody's excited. I mean, the same date can be a disappointment or a thrill depending on the context that you set it in. And if you set the date and you do better, people are happy. If you set a date that's earlier that's not realistic and you do worse, people are very devastated and disappointed. And that's one of the things that's happened in the pandemic is that there's this video and I can't even remember whose it was where very early in the pandemic, I sent it around to my teens and it was a retired CEO and I'm gonna mess it up. So I'm not gonna say. So, and he had this video that said, look, don't set an end date for the pandemic. Just put one foot in front of the other and focus on what needs to happen now because the people who don't set an end date will be more resilient in the long run than the people who set an end date. And then if that end date is not realistic, they're disappointed and they're almost devastated and they have to pick themselves back up again. And so to me, it's really much more about, okay, what's important now? How do we think about that? And as I said earlier is like, how do you shorten the cycle time between decisions so that people can feel progress even if they can't feel the complete outcome and then be completely data driven on when our expected outcomes are gonna be. Interesting that the one promise that was done well is Biden 100 million in a hundred days. I mean, the US is doing better actually. And then, it looks good. And everybody's happier, right? I mean, I think that, except for those of us in Pennsylvania and clearly Massachusetts, but I think that, it's like, if you set a date that people can get their heads around and you do better, everyone's like, God, that was great. As opposed to something that's just completely unrealistic. Another team here is looking ahead over the next five years. Where do you see the most important investment in supply chain technology, supply chain digitization? So for us, and I think every industry is a little different but for us, our investment in digital and our investment in intelligent automation is crucial. So the more we can predict outcomes, the more effective we can be, the more agile we're gonna be. I think one of the things that the pandemic showed us is we can have wild swings in demand. And I'll use our medical device business as an example. It's certain points in the second quarter. The surgeries around the world were so much lower than we expected but then they came back so much faster than we expected. So how do you make sure that you're always positioned to sense when that demand is coming and then be able to react to it most efficiently and effectively so you don't create waste in the system?  And so really being able to look at that and really understand the dynamics of what's going on all the way from sensing what consumers and patients are gonna need all the way back to your raw material supplier and being able to have everyone have that visibility to that. That's the crucial element of what we're thinking about. And then the other half of that is being able to run our lines most efficiently and effectively, I mean, sensing is cheap now, right? So how do I sense the line to drive best yield, best outcomes, run the lines most efficiently and effectively without having to do as much offline testing and batch support in order to be able to get speed and efficiency. And so it's those combinations both on the physical side and on the demand sensing side, that are crucially important.  So the closer I can get to that, the better off we're gonna be in order to be able to meet that demand with reliability. And so how do we get that to work differently? And the other piece of this is, how do we work across both the functions and the suppliers in order to be able to all be able to work that way? So that we're all looking at the same set of information. And so I was talking to our consumer health CIO the other day and we were talking about the fact of, what are the data sets we all need? And then what are the algorithms we wanna run against them? So that we're all working together and we're only creating data once and only working for data once. Because as we've all invested in digital, we have silos of cool stuff going on. Now the point is to pivot those silos to true end-to-end power, to be able to drive that performance, not just for us, but for our customers and for everyone, because everyone's investing. And how do you make it just one continuum so that we can all get better? You were describing actually an age-old challenge in supply chain. It's part of the bullwhip effect. You have too much to do at the end of the line. But with this, Mary, I want really to thank you for taking time out of what is really effective schedule and for you and your team. And I wanna thank the audience for joining us and please feel free to get, to be involved in the discussion with us on LinkedIn or at ctl.mit.edu. And thank you again very much for joining us and for watching and have a great day, everyone.


First of all, I would like to thank you for all here and the provider as well for their precious invitation for us. Regarding to my presentation, it's regarding to landscape architecture because maybe somehow my background is an architect and urban designer. So my emphasis will be upon the architectural role in mitigation negative climatic impacts upon urban environment. Mainly as a point of being introduced from the beginning. I would like first this is to all of us agree that we have in our climatic chest problems such as global warming and sea level rise and erosion and so on. All of our world is a small world. Now after what's going on in this global warming, whenever something happens somewhere the impact go to other where automatically. Therefore, the dramatically affected in developing process resources and people live food and so the creating the human life for urban cities. And be considered that not only poor people or not to say poor people, let's say low income or let's say low standard of living within city level level hood exposed for the impact for the climate chances phenomena. But also all people in different economic levels are accordingly to near countries as well. Therefore, dealing with this negative impact is considered a challenge that face developing a country as well. According to the this to continue with my colleague producing in his presentation, and this is the spring in Mina cities and so on. We face that there is a sort of mass between applying the the normal. Let me say that about about applying the economic plan and the developing plan as well. And what happened in this circumstances, especially with this event. So my point of view when I studying the landscape architecture wise or branch to focus upon the mass happened regarding to this issue. Okay. For for this minna cities as you see in this in this part, which my emphasis here is respecting the division that we live in a small world. That the change impact are dramatically increased due to the absence of integration between minna cities to manage and control such a problems. Therefore, the resulted miss design of landscape architecture between produce adverse impact in general to the environment and in particular in particular to the cities urban area. So we are expecting that the bill will be high and it will increase in consequently. It's not right that to say that I'm here. So I have to focus upon my problem not to see the other as a neighbor for me. Therefore, this image I this photo I pregnant for us here to say that it is not right to focus upon our local and neglecting to the surrounding environment. On April. So about diagnostics a problem that there is some questions come always to our mind that should be highlighted. Is there conflict of urban planning policy and structures in cities, urban developing or is there misapplying of landscape architectures and urban planning policy. And this is a strategy in cities, urban developing. And what will happen if such conflict occur between these levels. So my focus with here here is that the challenges dealing with the resulting problems is not simple. Mainly we have this very common problem that all of us knew. This is the deterioration for the standard of living according to this climatic change impact or negative impact. All of us familiar with this phenomenon. And then regularly many countries have not yet primitive lead to minister climate change problems. So my aim was focus that we have to present the possible solution to overcome the physical urban expansion problems for any extent that I give this example for for here for my lecture or for my presentation. This is a place in Cairo. This is all part it was like that. Very slum area consists of many deteriorating places. Then this is one of the landscape architecture project is develop this plan and give a positive impact to the surrounding. It's come like brief or long for the older Cairo. So the hype says that the landscape architecture work if we can properly design and go to design our vacant or urban spaces in a proper way. So there will be a positive putting in consideration that in our developing world we suffering from the shortage of awareness for the global climatic change and so on. You can find that very common. The awareness of people or residents are not mature enough to understand what is the meaning of climate change. What is the impact. What is this sea level rise and so on. Therefore my vision that if we can make like a landscape architecture chapter in this minna cities. This takes the responsibility in managing efforts and prepare prepare homogeneous policy between minna cities that can manage the effort of mitigating negative. A climatic change impact upon urban environment and then increase the public community awareness. So as we know that this is here the discipline that cooperation between or the multi-disciplinary that the landscape architecture and cooperate with all of this urban daily life. Therefore we can see that the landscape architecture is its emphasis upon all this discipline is within a city daily life. So again with climate change and the sustainability we have to take care about that. We have to look for the social and economic needs of generation. This is a common this shape is very common for all of us but all of this can emphasis or its emphasis of landscape architecture can deal with it positively to improve the life. Let's go deeply about what is there for this landscape architecture. What are the pointer that they respected in the work. What are party members and what is the role of landscape architecture in controlling the impact of climate change for considering or respecting the sustainability side of vision. This here we can find I apologize for it because it's not clear for this. But this is general organizations and this is evaluator or all of these governmental decision makers and investors and public participation. All of them are party within our group should be in landscape architecture work. For any sense we would like to develop this is the result which we need to have in the future. So dealing with the landscape architecture or climatic changes in minna cities should be unique in vision with city minna cities. For instance in Egypt or seriously design that we have to deal with this issue in regional level governmental level. And to the local levels is starting from the policy and in the with the action plan. And this is here one of the samples they bring it for us. This is here the scenario that starting from the policy in all in Egypt that end by emphasis upon one of the city. This should be the normal or the proposed way. But unfortunately this is only theoretical because the awareness of cooperation between the three levels is not matching well. Therefore a mess result from that. About motivation motivation for selecting landscape architecture in facing climatic change impact. It's important to understand the landscape elements as we know that a landscape architecture element always deal with softscape hardscape and its components. So it's not only landscape for agriculture. No it is should emphasis on social and daily life and this to develop the human life within people there. So we can see in this photo as you can understand or can see sorry if you can see here we can understand from this image that landscape architecture here or the vacant area it's missing here. So this pattern consists of buildings no concern regarding to vacant area or developing to make a brief parts or to developing it as well. This is here a path for urban construction buildings. Negative matching according to the climatic change as well. Of course we would like to develop the city. So the scope now if we have to deal with urban design with site planning and urban planning and environmental illustration and park and so on. So if we would like to apply all of this to avoid this mess of urban consequence. So we have to think in the focus or under the umbrella of landscape architectures. Okay. You can see here for this is for for any sense this is here the traditional shape of buildings we are looking for developing the vision or this the photo for the image of the city to become like that it's suitable so we can decrease the temperature within city urban spaces. And as well as the consumptions for energy it will be less. So conclusion for the for my analysis that in many cities suffering from unplanned urban developing and neglecting suitable and the proper landscape architecture vision and design as we see in the previous shots that most of the cities. This is as a sample which I present for you most of the cities are suffering from the same vision that neglecting the landscape architecture vision. Then there is another story that there is always conflict between winner cities planning policies in facing climatic change each one of them dealing with this problem like an island separate island between each other is not cooperation. Even within for instance for Egypt as an example we can see that each city of them dealing in a separate philosophy separate way. In fact it should be like a policy together all of them in one shot. And we have again to continue with my colleagues said that we have to monitor and we have to have accurate data about the circumstances the current circumstances the rate between urban and open spaces vacant and build up area. So we have to give decision makers the proper circumstances or the conditions of the city. Therefore that updated the situation of the landscape architecture in urban should be within the planning and measurement and have assessment and evolution in accurate data to avoid the conflict of implementing each mean a city in a separate. Therefore a unique vision of landscape architecture and environmental planning should be created. Especially respecting human behavior and urban and natural resources and system of government and urban management. Which in real is missing in our circumstances in the many in most of the many cities. Therefore to control the negative impact of climate change. This is the main tools we have to focus on for any sense for softscape species and vegetation type in performance should be highly selected in a proper way proper way that matching or matching with a local environment. Not to import the vision from anybody from any place to others without any sound of base then selecting hardscape material to avoid reflecting from sunrise to the ground and reflect as well. And the design aspects and the concept social and economic issues environmental consideration and ethical wise and physical urban spaces. As a recommendation from my vision that in many cities we have to think global vision. How can we make a global vision that we have to cooperate doing this comprehensive policy to make like a sort of cooperation between these many cities and make the landscape architecture chapter to create landscape architecture chapter. We can see it center but I mean to make a chapter that to manage and make accurate data. And this is the main asset is chapter should follow the UN vision to continue the effort to play important introducing the adverse impact and as well to give a sort of accurate data about the current version for urban spaces. We can see here this is for instance if we'd like to I wonder if it's clear for not that this is here the part of the meanest cities for instance we can take this like this part this here chapter this here another chapter and this another chapter to have some sort of monitoring or observatory centers to give accurate data then start from this accurate data to reflect and make developing for the landscape architecture and develop the way of the develop the urban condition and the quality of life and standard of living. And it's most important issue that to increase the awareness for the residents because if somebody is working for us to hear about that what is the meaning of climate change and he doesn't know what the meaning of this and just blah blah blah say this climate change without any sound of base therefore the result will be a disaster. And finally this is increasing this awareness with will reduce a minimizing water consumption which is very dramatically vision now because the high consumption of water and as well to use a friendly environmental material and eco material for the for the environment. Therefore we'll have somehow comfortable environment for the resident and this is will be inshallah one of the most target for our work. Thank you very much for your representation for your listening. I hope my presentation is clear for you. Thank you very much.


Hi everybody and welcome again to another Tech and Talk. Tech and Talk is a podcast we've started this summer, bringing you some fresh ideas and some deep dives on things, mostly cloud native-y, but from all sort of different parts of the technology that we get to use in our cloud native application. So sometimes we'll sidetrack, but today we're not sidetracking. We're really gonna go for some interesting conversation with first and the newcomer, who's, as it says on the screen, a security strategist and very passionate about security here at Red Hat with me. And she's kindly offered to reprise a presentation she's done called Ten Layers of Container Security, which is rockin' awesome. And I'm really glad to have Kirsten here with me. So I wanna let her do her talk. You can ask questions in the chat. We'll have live Q&A at the end and a bit of a conversation. So without any further ado, welcome to Tech and Talk, Kirsten. All right, thanks so much, Diane. So really looking forward to talking with everyone on this topic. I'm gonna just kinda start not by talking about what containers are, because I am assuming that most of you already have a good idea about what containers are. And if you don't, I know that there's some terrific content already recorded and available on OpenShift Commons that you can, where you can learn more. But what I did wanna call out really is that containers change how we develop, deploy and manage applications. And for that reason, they really affect both the development and the ops team. And there are different advantages for each team. We typically think about containers as really providing advantages for the application development team. You get to package everything up with all its dependencies in one place. You can deploy that same container to any environment you want your application to run and you really minimize the configuration challenges that you have. And it makes it much easier to share your contents and your components. But there's also real advantages for the ops team, right? Container application, it has a smaller, lighter footprint. If you choose to run on bare metal than running containers on virtual machines, of course you can run on both. And they're more easily portable across different environments, whether it's bare metal, virtual as already mentioned, or public cloud, private cloud, wherever you want. That said, it's really important that security be taken into account when you think about adopting containers, especially in an enterprise environment and for the production environment. And as you think about shifting workloads, the security team typically becomes involved and concerned. And so you want to be prepared to talk with your security team and both as an ops and as a dev team about how do you work securely with containers? And that's what this conversation is all about. So we think about securing containers in multiple ways here at Red Hat. We think about both the layers of the stack, of the solution stack, and the container life cycle. So I'm gonna go through each of these elements kind of one by one. So I'm not gonna kind of touch on them now. I'll just mention that you don't really need to be an expert on each of these areas for today's talk. I'm gonna kind of go at a reasonably high level. And if you have a particular area that you'd like a deep dive on as a future talk, let's tee that up with Diane afterwards. We'll be happy to get into more. One other note is that I'm gonna be talking about, these are all things, the security things that I'm talking about are all things that you can do in a DIY container environment. But I'm also gonna use OpenShift as an example for how it's implemented with a container platform and how that makes it easier. But certainly these are things that can be done, both DIY and with a container platform. We're gonna start with the container host and multi-tenancy. So many of our security teams have really gotten comfortable with how to secure VMs and to get a little more concerned when the technology shifts to containers. And so from that point of view, the OS that you deploy your containers to really does matter. You wanna be sure that you're taking advantage, that you have an OS that provides security capabilities and that you take advantage of those security capabilities. So of course, from the Red Hat point of view, that's Red Hat Enterprise Linux and Red Hat Enterprise Linux Atomic host. A couple of the key capabilities to think about there and since this is a tech audience, I can get a little bit into these. Linux namespaces provide the fundamentals of container isolation. The namespace provides abstraction, makes it appear to the processes within that namespace that they have their own instance of global resources. So that's a key element to rely on. SE Linux is used to keep containers isolated from each other and from the host. It allows administrators to enforce mandatory access controls for every user, application, process, and file. It's the brick wall that's gonna stop a process if it manages to break out of, accidentally or on purpose, the namespace abstraction. You know, a really concrete example here is that SE Linux provided mitigation of a discovered container on entry vulnerability for those of you who really wanna go there. You can look it up. It's CVE 2016-9962, but SE Linux was able to prevent processes from accessing host content even if those container processes managed to gain access to actual file descriptors. And Dan Walsh did a great blog on this, also something that you can look up. Control groups, again, because you're one of the advantages of containers is you can run multiple applications on a single system and because they're packaged with their own dependencies, you don't have to worry about configuring that VM with what if one application requires a different version of Tomcat than the other. You can do that with your container environment, but you wanna be conscious of being able to limit, account for and isolate resource usage. So that involves your CPU, your memory, disk IO, network, et cetera. SE groups allow you to ensure that containers won't be stomped on by another container on the same host. And then finally, the secure computing mode profile can be associated with a container to restrict available system calls. So really, all of these are security capabilities that you can use for any running process. And in this context, you wanna think of containers as another running process and apply those security features and functions and principles that you would apply to any running process. It's worth noting that, so I'm sorry, another thing to think about if you want to further enhance your security and minimize your attack surface, Atomic Host is the host for you, right? That is a container optimized operating system and it really makes it much easier to it's specifically tuned for containers and really only has the packages that you need to run containers and there is no yum install. So people can't go out there and arbitrarily add different packages to the environment. A further proof point of the security features available with Red Hat Enterprise Linux is that REL 7.1 received common criteria certification, including certification of the Linux container framework support. So all of these kinds of things I've been talking about. And so I'm not talking about the Docker runtime when I say that, right? But all of these surrounding capabilities were the first Linux distribution to receive that common criteria certification for the Linux container framework support. Okay, so that's the OS and multi-tenancy. We also want to think about the content in your containers. Applications and infrastructure these days are really built from existing sources. Absolutely you add your own code, but you're often building on top of open source components such as the Linux operating system for your infrastructure, Apache web server, JBoss Enterprise application platform, Postgres, Node.js. So containerized versions of these packages are now readily available and you don't have to build your own container for the containerized version of them. But as with any code you download from an external source, you need to know where the packages originally came from, who built them and whether there's any malicious code inside them. So Red Hat provides a large number of certified images, including the rail base images, various language runtimes, middleware databases and more on the Red Hat container catalog. Red Hat certified containers run anywhere Enterprise Linux runs from bare metal to VMs and they're supported by Red Hat and our partners. So the container image content that we deliver is packaged from known source and Red Hat provides security monitoring on these packages. So you can see in this screenshot, this is a screenshot of something we, a feature that we added to the container catalog in May called the Container Health Index. So we are publicly exposing the grade of each container image detailing, information you might need about any known vulnerabilities so that you can be sure that you are aware before you download the content of the security aspects of that container. And of course, we keep up to date with security fixes and patches and we will rebuild those container images whenever security fixes are released, as you can see in this screenshot, version 3.4-1315, new vulnerability was discovered, we released 3-4.1316 with a vulnerability fix and the grade went back up. Of course, there are gonna be times when you need content that Red Hat doesn't provide and in those situations, we recommend you use container scanning tools. There are a number of them out there on the market. Many of them use continuously updated vulnerability databases and they will help you identify the open source components inside the container image and identify any known vulnerabilities associated with those components. Some of the scanners will also do commercial software, but a majority of them are really focused on open source content. So you can think about things like J-Frog X-Ray, TwistBlock, Aqua Security, Black Duck Hub, these are some of the things out there. For Red Hat content also, we provide a scanner called OpenSCAP that you can use as well. So you've got a bunch of content that you may have downloaded from a public source, but that's really only the starting point for the applications that you're building, the applications that really drive the business value for your company. So you want to be sure that you manage access to and promotion of the container images that your teams use, both the ones you download, but also the ones you build, just as you would manage access to and promotion of any other type of binary. So you can do that using a container registry or a binary repository that knows how to work with containers and you start to see both terms used in the industry these days, but typically they're referring to things like J-Frog's Artifactory, Sonotype Nexus, binary repository, Docker Trusted Registry, and OpenShift comes with an integrated registry that we call the Atomic Registry. You can use to manage your container images, but OpenShift also integrates with the popular binary repos registries, container registries that are available, the ones that I've already mentioned. So when you think about a registry, you want to be sure that it provides that it enables you to store and see security metadata on your images, that you have access controls, that you can do things like say, hey, this image is okay for deployment and production, but this image, this other image is only okay for deployment in a development environment because it hasn't been fully vetted yet. So you really want policy controls, the ability to apply policy controls in your registry as well. And one of the big values here is that, if you have those kinds of policies in place, or if you choose to have multiple registries, maybe one's only for DEV and for Sandbox and another is only for production, you can make it easy for the DEV teams to use things that haven't yet gone through the full vetting process and explore, but you make sure that they don't get into your production environment unless they've been fully vetted. Similarly, builds are a really important part of the security process, right? As with any application, managing production builds is a key element of your process. You need a definitive build environment for your production container deployment. You really don't want developers doing Docker build on their laptops and then deploying that build to production because that's not a reproducible build environment. So you want to integrate your container build process to use the kind of automated and integrated CI process that you do for other types of applications. And if you're not doing that yet, you should really be looking into it. There are a lot of great tools for automating your builds and doing continuous integration. OpenShift comes with an integrated instance of Jenkins for CI and can also be integrated with your own CI environment if you prefer. And again, if you're doing this yourself, you can put together a process that includes your preferred CI tools. You don't have to have a container platform. We just think it makes it easier if you've kind of got everything in one place. There's less for you to maintain. And you can let somebody else maintain it. So once you've got a build completed, the image should be pushed to a registry just as we've been talking about earlier. And that can be done automatically when you use OpenShift, for example. You also want to be sure again that you proactively check container contents over time. New vulnerabilities are identified daily. So just because your image was vulnerability-free at the time you did your build, doesn't mean it's going to stay vulnerability-free even if the code hasn't changed at all. So again, you want to leverage tools like OpenScap, Black.Cub, JFrogXray as part of your CI process. Just like you would integrate other types of security tools like security static analysis tools like IBM Rational App Scan or HP Fortify. Look that you use to look at your own source code. You want to use these other types of security tools to introspect the container images that you're working with. Another really great thing about containers that actually can help you to enhance the security in a more automated fashion is the Laird Packaging Model. So that Laird Packaging Model, if you work in a regulated environment that requires separation of concerns in some cases, the Laird Packaging Model really helps you do that. You can have your operations team be responsible for the core build, perhaps the rel images that they pull down from Red Hat. You can have your architects be responsible for adding the middleware content. So layering the middleware content on top of that core build image. And then your app dev team really only needs to think about the code that they need to write to develop that application and build that full container. And when you take this kind of approach and you have a fully integrated or automated apologies, a fully automated CI process, you can also look at triggers to help you know when to rebuild containers. So those triggers really kind of span both the container build and the container deployment topic. So I'm gonna talk about them a little bit here. But before I do that, let's talk again about some additional things you need to do around deployment and continuous deployment for security.  Well, it may be that without realizing it, you've got a container, an application container that requires that it be run with root privileges in order to do everything it knows how to do. But your security team or your production team has a policy that says no container is allowed to run as root. And in fact, that's a really good security best practice, don't let your containers run as root, just don't do it. So you wanna leverage any capabilities you can to do things like automatically prevent privileged deployment of privileged containers. So Kubernetes and OpenShift come with something called security context constraints, which allow you to do that automatically. You can monitor that, I'm sorry. So you can make sure that the SE Linux context is defined for a container, you can check to see if it requires root privs, if it does, you can prevent it from being deployed, whole sets of things that you can do here. It's also worth mentioning at this point for any of you who are really familiar with SE Linux, a lot of folks are used to turning that off in their base role images because not every application knows how to run in an SE Linux environment. One of the nice things about the containerized application running on OpenShift is that OpenShift manages SE Linux for you and containerizing that application means that you can take advantage of the protections SE Linux provides you without having to worry about those SE Linux elements. So it really gives you the ability to have a much more secure environment. So back to triggers and thinking about image registries. You want to monitor those image registries again to make sure that you become aware if a newly discovered vulnerability shows up. And if it does, you want triggers in place to make sure the appropriate people know about it. So let's take a look at an application that's built using the three container image layers that I talked about earlier. Core, middleware, and finally the application layer. If an issue is discovered in the core image and you've got these kind of monitoring capabilities available, you'll get notification that that core image has a known vulnerability. You also ideally would get notification that a new image is available from the original public repo you pulled that core image from. These are capabilities that OpenShift supports. So you get notification and you can then using these triggers automatically restart your CICD process for that application so that the core and middleware image is rebuilt using that updated core image and then the application is rebuilt using that updated middleware image. And you make sure of course that as part of this the application goes through all of its security tests and it's UAT testing. And now you're in a position where you can deploy the updated container to an environment. You don't need to take down the old one yet. You deploy that new one, you migrate users over, you make sure that everything's up and running good in production and then you can take down that vulnerable container. On the other hand, if it's a severe vulnerability you may decide you wanna stop that container right away while you go through this process. So by leveraging and automating your continuous integration and continuous deployment process with OpenShift the entire process of rebuilding the app to incorporate latest fixes, testing and making sure it's deployed everywhere within your environment can be 100% automated with whatever additional gates and policies you wish to incorporate. Let's talk a little bit more about the container platform. So if you're using, one of the big reasons for using a container platform is the orchestration features that help you manage container deployments at scale, right? You need to, you really want again, automation, orchestration to help manage which containers should be deployed to which hosts, monitoring host capacity, container discovery knowing which containers need to access each other and controlling access to management of shared resources, monitoring container health. So all of these things are typically offered through your orchestration platform, right? And OpenShift delivers orchestration through Kubernetes which many of you know probably was originally developed by Google. So one of the key concepts of a container platform in this orchestration is that it's the master nodes that really have all of this controlling and capability to kind of manage deployment and process around the places that your application containers are deployed. And for that reason the masters have a fair amount of privilege in order to do that work. So you really need to be sure that you have strong multi-tenant security on the platform itself. You want to be sure that you have the ability to isolate different teams, applications or deployment environments from each other. You may want to do something like say isolate a dev, a test in a production environment from each other. That's a pretty common use case. And one of the other things you really want to get out of a container or platform is the self-service capabilities that really make it easy for the dev teams to do what they want to do and really helps kind of make it faster to get those applications out there that again support the business value. So you need to balance what the dev teams need, that nice self-service experience with the ops and security teams needs for really kind of managing security of that production environment. And a really good container platform helps you do that. Some of the other things, and actually let me talk So part of that, part of a secure multi-tenant master making sure that all access to the master is over a TLS, controlling access to the API server, ideally, an X.509 certificate token based, the ability to use project quotas to limit how much damage a rogue token could do. All of things are things you want to be sure you've got. Ideally, you also want to be thinking about a platform that supports image signing, right? Makes it easy as you build those images to sign them. Maybe you use external signing, but you also need to verify the signatures as part of your deployment process. And you want secrets management. So this is a place where the OpenShift has some capabilities today, right? You can mount secrets into containers using a volume plugin. The system can use secrets to perform actions on behalf of a pod. XED is the place where OpenShift stores tenant secrets today. And today, in OpenShift 3.5, that's not, XED is not as secure as many enterprises would like it to be. So this is a place Red Hat is investing. And when OpenShift 3.6.1 ships, we will have secrets encrypted at rest in XED. We're also investing to make it easier to integrate external certificate authorities and vaults for improved secrets management. So there's a lot that can be done in this space already and more to come. And again, you also want to think about integration with the security ecosystem and how well the platform performs there. And we'll come back to that a little bit later. Okay, so network defense, right? Traditional data centers, traditional applications, network defenses is a big part of the way the security team thinks about this. How do I manage? How do I protect my internal environment from the external? How do I segment things on my network? But, and you need to think about this for containers as well. That said, really, we think one of the best ways to do this, given the scale at which containers are coming and going in an enterprise environment is you really want to be using software-defined networking as a way to help automate this. So the first line in network defense comes from network namespaces. And with, okay, so sorry, this is the area that I'm least deep in. So I rely on my cheat sheets here. So, and if you guys want a deep dive on this, I know just the person to have to come in and do a deep dive. So, but like... You haven't been using cheat sheets the whole way because I am totally impressed by that. I use some cheat sheets, I'll admit it. It's a mix. There's a lot of acronyms in there so far just to slay me. I have the one that just popped up. This might be a good time just to ask it. Edward was asking, is there, because you showed us the registry dash health check and that I think is for Red Hat images, for Red Hat Red Hat. Is there something fit into OpenShift or is it all third-party stuff that shows that would have a health page for container images or something similar in the OpenShift registry? Oh, that's, yep, that's a great question. There are a couple of ways to show security data in the OpenShift UI and you are correct that the Red Hat Container Catalog today provides the health index just on Red Hat images and we may extend that over time to the rest of the images that are available from the Red Hat Container Catalog. All the images are supported but the health index is only available on Red Hat content. So, when it comes to looking at security data in OpenShift itself, there are a couple of places that you can see that show up. So for example, OpenShift comes with a tool called CloudForms which is part of the management offering from Red Hat and it helps you kind of manage across a wide variety of deployment environments and OpenShift is one of the ways, I'm sorry, CloudForms is one of the ways you can run OpenScap scans, which I mentioned earlier. So if you need to know the vulnerability data about Red Hat content, you can, you know, and maybe you aren't going back to the image for the Container Catalog for some reason, you've already got that image stored in your registry. You can run an OpenScap scan and if, and there is a UI, I don't have a screenshot in this deck, but there is a UI where you will see the results of that scan and if there's a known vulnerability discovered and you have your policies set appropriately, you can prevent deployment of that vulnerable image. You know, so there are multiple ways to prevent deployment of vulnerable images. The Atomic Registry also has a GUI and I'll be honest, I'll have to look, you know, get one of my colleagues to tell me exactly what's visible, whether the metadata that I was talking about is visible in the GUI, through the CLI, I will look into that. But registries like JFrog's Artifactory Registry or Sonotype Nexus, they absolutely do show you that kind of vulnerability data and many of the scanners have integrations so that you can see some of that data from other third-party scanners in those registries. Thanks, sure. Okay, so back to networks and namespaces, right? So with network namespaces, each collection of containers known as a pod gets its own IP and port range to bind to, which allows you to isolate pod networks from each other on the nodes. And because again, the proliferation of IP addresses and ports makes networking more complicated when you have a large-scale container deployment, we really strongly recommend using SDNs to a software-defined networking to help you handle that complexity. So OpenShift comes with the OBS multi-tenant plug-in, right? So OpenShift platform comes with software-defined networking. You can also plug in other SDNs if you have a preference. An example might be Nuage, would be another software-defined networking that you could plug in to OpenShift. And so, but the real point is that you wanna make sure that if you're doing a container platform that it has the ability to leverage software-defined networking, that it gives you the ability to plug in the SDN of your choice. And again, that really doing this at scale is gonna be very difficult with traditional networking tools. That said, you can also, you know, another thing that comes up frequently with security teams, they're used to using network scanners as part of their protection scheme for the network environment. So what we recommend around that is that many of those network scanners, if they're not yet designed for software-defined networking, tools like those and others like them can be containerized and can be run as super-privileged containers. You just have to make a special policy for them to give them the level of privilege that they need. But it is one of the things to think about. There's actually a lot of capability available in these solutions. And so definitely worth thinking about there. Something else to mention quickly, right, is that there is the ability to control egress traffic using either a router or a firewall method so that you can use, again, more traditional methods such as IP white listing. You might use that to control which users have access to certain databases. And introduced as a tech preview in OpenShift 3.5, there's a new network policy plugin that improves upon the way the OBS multi-tenant plugin can be used to configure allowable traffic between pods. So the network policy allows configuration of isolation policies at the level of individual pods. And this is still in tech preview in OpenShift 3.6, but again, lots of great capabilities here. And this is a space where a traditional security team will be particularly interested. Okay, trying to keep an eye on the time too here, but I think we're good. Storage, right? There's a lot of conversation today about stateless applications, et cetera, et cetera, but there's still a lot of applications out there that need storage. And even if you're doing a stateless app, you might want to store some information somewhere. And so that's really where attached storage comes in. And of course, you need to secure your attached storage. So a container platform with orchestration tools again, makes that easier. OpenShift has plugins for multiple flavors of storage, including NFS, AWS Elastic Block Stores, GCE Persistent Disks, Gluster FS, iSCSI, Seth, Cinder. And the way in which you protect your storage volumes really varies depending on the type of storage. So a persisted volume can be mounted on a host in a way that is supported by the resource provider, such as Read Right Once, Read Only Many, Read Right Many, Block Storage, such as EBS, GCE, iSCSI, you can use your SE Linux capabilities to secure the root of the mounted volume, making the mounted volume owned by and only visible to the container it's associated with. And for shared storage like NFS, Seth, or Gluster, you can manage that by adding the group ID of the persistent volume to the supplemental groups of the pod. So, and then by default, you want to be sure that data in transit is encrypted, which on OpenShift it's encrypted via HTTPS for all components communicating between each other. API management is another thing to think about, right? Again, as especially when we start thinking about, you know, newer applications that are composed of microservices, but also really for any application that has externally facing APIs. You really want to think about how are you going to get appropriate governments of those APIs. And one approach that we'd recommend is using an API management tool. So OpenShift now includes a containerized version of the ThreeScale API gateway that helps you manage API security. So ThreeScale gives you a variety of standard options for API authentication and security. And in addition, you have the option to use application and account plans that let you restrict access to specific endpoints, methods, services, and apply access policies to groups of users. One of the cool things about application plans if you use an API gateway is that they allow you to set rate limits for API usage and control traffic flow for groups of users. So this is a way that, you know, and you can also automatically trigger overage alerts. So that can sometimes be a good indication if you get a sudden spike in usage, you know, you want to be able to stop that quickly. It could be an indication of an attack. So if you're getting alerted about overuse, you know, applications that reach or exceed rate limits, gives you a great indication that it's something that you need to look into. So a lot of good things to think about there too. Okay, federated clusters. This is actually a futures looking, or a forward looking slide. And something that Red Hat and the Kubernetes community are working on. Federation is useful for very large scale, high availability global deployments that require multiple clusters and multiple availability zones. You can use federated clusters to, the concept is you can use this to manage more than one data center in different regions, but also, and that could be with the same public cloud provider or federated clusters might, will also help you manage across different public cloud providers. So there's some really cool stuff coming here. And if you're managing federated clusters, you need to be sure again, that your orchestration tools have the security you need across those different deployment platforms. So some of the key elements that are in the works here are federated secrets, giving you the ability to automatically create and manage secrets across all the clusters in a federation, making sure that the secrets are kept globally consistent and up to date, even when some clusters are offline and federated namespaces, right? Creating namespaces in the federation control plane to make sure they're synchronized across all the clusters in the federation. Once again, this is forward looking. This is something that's in progress. There are elements of this in Kubernetes today and Red Hat again, is working with the community to get these ready for enterprise support. I mentioned the security ecosystem earlier. So again, if you're a security professional or you're talking to your security team, there's a whole series of security tools that the security teams are already using today or that they really want to be sure can be used in a containerized environment. And so some of these include special identity and access management tools. Of course, most of us think about things like active directory, but there are also tools that are focused on privileged access management and security teams often use those tools to make sure not only that they're controlling privileged access, but that they can audit it. I mentioned earlier, external certificate authorities, external vaults and key management solutions, the container content scanners that I've talked about as well as other types of vulnerability management tools. There are also some container runtime analysis tools, both Aqua Security and Twistlock. Do some container runtime analysis, those are useful. And again, you want to be integrating with your security team's information and event monitoring system. So you want to be collecting the logs from your container deployment, both the platform and the applications, but in particular the platform is probably the most interesting thing to your security team. You want to flow that information into that information and event monitoring environment so that it can be aggregated and viewed in the tools that the teams are used to. So again, you want to be sure that as you look for really, really look to product ties and broad scale deployments that you are thinking about solutions that help you do this kind of integration. So as said, we think of course that OpenShift is one of the best ways that you can do that. We support all the kinds of capabilities that I've been describing. And in addition, of course you can do this yourself by using some of the open source community tools. We think you get that added value from OpenShift of having it all in one place, having it be supported and knowing that you've got a stable enterprise partner to work with and help you manage all those pieces together. Diane will have a PDF available of this with some links to some additional information, including the 10 layers of container security goes into kind of a lot of the content that I've covered today and in some cases in more depth. And I would be happy to take questions. All right, well, there is one more question here and really thanks. Because first, thank you for doing this because one, I do lots of talks on each individual aspect of security. And just last week, we did something with New Vector who was doing network security and SDN, like checking out the network layer. And I think this is the first time that I've seen someone do a presentation that covered enough of each of the different areas so that you actually understood how they were all interconnected and necessary. So this has been great for me because it sort of pulls all of that together. And I mean, I really appreciate it. So thank you for that. Edward is asking a question you mentioned like you mentioned Twistlock and Aquasect and JFrog and a few others as well. But he's wondering if you have any thoughts about Sysdig, Falco, or other utilities to help monitor, you get to play with all of them so in your role. Those are good questions. And I'll be honest to say, I'm not as up to speed on Sysdig as I'd like to be. And I'm not sure if I've heard of Falco before. Is that FALCO? Yeah, that's what he's saying. And I'm going to unmute him so he can ask his question. He can unmute himself too. And let's see if we can get him to do this. Where is Edward? There we go. Steve, Edward, Edward, how about if you ask your question? Okay, yeah, sure. Thanks for this, Kirsten. Yeah, we're looking at some utilities to help monitor containers, running containers out. So we've kind of found the utility from Sysdig their utility that's sort of like a TCP dump, but they also have another product called Falco, which allows you to set up a policy and a learning. So if Shell gets spawned up in a container, that can be a message that alerts a team or so. Okay, interesting. Well, I will definitely make a point of learning more about those. It sounds to me that Falco at least would be complimentary with something like Black Duck Hub or JFrog X-ray. Twistlock and Aqua Security have two solutions that, and one of which may be an interesting one to explore. So both of them have scanners and then container runtime analysis. And at least my understanding of how the Twistlock runtime analysis works is that it takes a look at all of the information in the Docker file and everything. Kind of when it takes a look at the container image before it's launched, it collects a bunch of config info. It also monitors kind of the initial behavior of the application in the container when it's first launched, so that it gets a sense of what the pattern is for the container behavior. And then if it sees deviations from that pattern, it would also notify. So I don't know how that compares to the way Falco determines when to notify you, but I will definitely look to get up to speed on both Sysdig and Falco. So I know that I had the Sysdig folks on before in an OpenShift Commons briefing, so I'll post a, Edward, I'll send you an email if you share your email with me with some links to that. But about three weeks ago, the AquaSec, Liz Rice did a tech and talk and she's also done a really interesting open source project under the AquaSecs. It's in their GitHub repo called KubeBench, which takes the, I'm gonna say it correctly, the Center for Internet Securities, Kubernetes Benchmarking tests and automates them to run against your Kubernetes, a really interesting project. So you might wanna take a look at that, Kube-Bench is something that's also out there and you could possibly take a look at. And on no new vector is also using those security benchmarks too in their offering. So the thing about security, there's so many angles at it, but it's interesting to see the different approaches people take and your question earlier, Edward, about the dashboard stuff and I'd love to see a visualization even if it's a third party one, baked into OpenShift as well, so that it was alerts. And that's part of the thing I can, normally in tech and talk, I'm not so OpenShifty, but one of the things is OpenShift can't be everything to everybody. So we really love working with these third party folks who are experts in these things and integrate very easily with OpenShift and Kubernetes. So there's lots of content out there. So please. Yeah, absolutely, a comment on the Kube-Bench, the CIS benchmark, my best understanding is that you use those benchmarks really for making sure that the overall deployment environment is secured after the platform and the environment and that something like Aqua Security, Twistlock, and it sounds like also Falco are more about the behavior of the application. Edward, is that right that Falco's monitoring the application behavior? Yeah, correct, it's a kernel module that gets loaded and based on, I guess, a pattern or a call, you can have it alerts based on that event. Interesting. So I'm definitely going to look into that. Cool, thank you. Love it when I learn something new. Yeah, I absolutely adore hearing a new one. So, and also I will try and get someone from the CloudForms team to do a talk on the OpenScap scanning and integrating that to come time and not to this in the future. I know just the person for you to reach out. I remembered reading a blog post somewhere and I found it and I popped it into the chat for folks. If you know the person, that would be great. Well, I was going to suggest it might be a different person, but go ahead. But who would your person be? Lucy Kerner does an awesome presentation on using not just CloudForms, but CloudForms, Ansible insights to automate the configuration of the initial configuration of security profiles. So using OpenScap and then to audit and automatically remediate as well. So she's got some great knowledge in this space. Yeah, I've heard her name, Vandy, but I think I've actually met her twice in the hallways at some conference because that's where I meet everybody from Red Hat. Never add a responsibility. It's always at conference. You know, yeah, you work for Red Hat? Oh yeah, yeah, cool. The other thing, I'm always looking for suggestions on other people to have on and the tech and talk on people who are passionate about some aspect of technology. Do you have any other suggestions, person? Yeah, you know, I do have one other person in mind and I just, but I probably, I did not get a chance to connect and see whether, you know, she, this is someone, I guess I can share her name. She's presented at other events publicly. So, Alex. Boris them. I'm sorry? Say again? Boris them. Yeah, no, I can put you in touch. But Alexandra Schulman is a VP of an innovation center at Citigroup and she's a great person. And of course, the people I'm gonna think of are in the security space, but she's a great person.  So she's a possibility. Perfect, all right. Well, I'm also hosting an event in December, the OpenShift Commons gathering and looking for speakers for that. And I've been trying to find a good security speaker. So that might be a good slot to try and force her into doing something there because KubeCon's coming up December 6th, 7th. And we always do a big OpenShift gathering the day before. Sort of think of it as a prep session for KubeCon and get all the updates before you go in. So then you can go loaded with questions. So we'll try and see if we can reach out and get some of those folks there. So, Kristen, thank you so much for taking the time today to give this talk. It really was awesome. I can't thank, you know, I'll add in the links that you had and post this as a blog post along with the slides on blog.OpenShift.com and tweet it out as well. And it'll be uploaded on YouTube under the technical playlist along with a lots of other. So again, thank you very much. My pleasure and thanks for the good questions, especially from Edward. I know there may have been others, but thank you.