Welcome to my presentation on measured boot and UEFI and thank you very much for coming and also I want to thank DEF CON. It's a great honor to be up here and this is a big crowd to be presenting to so that's pretty cool. My name is Dan Griffin. I'm the president of JW Secure. We're a Seattle based company that specializes in custom security software. So we've done a little bit of work in this space. Mostly what I'm talking about here is just kind of based on our experience on some recent projects that we've done for the past 12 to 18 months. Before we talk about measured boot and UEFI in terms of technical details, I hope you'll excuse me to go into a brief digression. I want to try to motivate these subjects with not quite a real world example but anyway what I thought was a cool one. Did everyone see James Bond Casino Royale, not the spoof from way back but the one with the newest James Bond with Daniel Craig that came out in about 2006? Yeah, he's hot. So and actually supposedly my wife just told me that he was in they did something with him in the Olympics opening ceremony.  I didn't get to catch it anyway. So if you didn't see Casino Royale or if you did a reminder the premise is that James Bond has to play a high stakes poker game to try to lure a financier of terrorism to the table. And so the idea is that if Bond can or I should say when Bond outwits the terrorist they'll be able to, you know MI6 will be able to bring in the terrorist and interrogate him for all the information he has about other terrorists. So here's the thing though. Before the game this guy on the right here in this picture, he's a Swiss banker. He shows up with this mobile banking kiosk. You can probably see where I'm going to go here. So you can kind of see, apologies I couldn't find a great picture of it without going through the movie and taking a screenshot which I didn't want to do. Anyway it's just this stainless steel thing that you can see. Surely it's just a laptop, you know. Anyway each player has to pick a pin code and they use that pin for securing their winnings if any. But what we subsequently learn is that James Bond uses his new girlfriend's name as his pin code. So does that bother anybody else in this room? So I can think of just a few concerns off the top of my head. Even just a few, and by the way the girlfriend's name is Vesper, V-E-S-P-E-R, okay? So not as bad a double entendre as like you know Pussy Galore or anything like that. But still fairly obvious, right? So even just a few socially engineered guesses on that pin, you're going to find it. And of course a brute force attack is going to find it trivially. Second, even if Bond had chosen a better pin, what if there had been a root kit on that mobile kiosk? Right, came over, right? And most of all, if Bond's account had been compromised before the end of the game, do for example the poor password policy enforcement? Or poor end point security enforcement by the bank? Do we really think he still would have gotten the girl? No chance. Now of course if you remember the movie you know that it didn't go down quite that simply. Turned it out the girl had some issues. I will remind you though that she's an accountant and so she surely would have cared. Anyway, obviously you know it's one of those things where it doesn't quite fit the plot for a real world security concern to come in. But that's the kind of thing that affects the rest of us, affects you and I. And it is very much a real world issue. So the question is, what can we do to improve end point security in scenarios such as mobile banking, not just for James Bond but for everybody? And with that in mind, UEFI is an important technology for protecting devices against root kits. Now there's some tradeoffs which I'll get to. And I also want to point out that the TPM chip can be used for protecting remote systems against compromised clients. So that kind of works the other end of the story and I'll talk in detail about that as well. So let's look at how these two technologies work. UEFI is the unified extensible firmware interface, kind of just rolls off the tongue. For the purpose of this discussion, UEFI is a programmable boot environment that is gradually replacing, let's call it just old school BIOS. TPM stands for the trusted platform module. It's a crypto processor typically implemented either as its own chip on the motherboard or as part of a secure execution environment and of course this is the direction that we're more commonly going now in system on a chip firmware. Secure boot is a feature of UEFI by which OEMs can control what boot images can be executed. Typically secure boot includes support both for whitelisting and blacklisting of code signing keys as well as of the boot binders themselves. So you can whitelist or blacklist a certificate or a public key and you can whitelist or blacklist, you know, the hash of the image itself, either one. On the other hand, measured boot is a boot loader and operating system feature and it uses the TPM to keep a record of early boot components as they load. Now a TPM chip isn't the only way that you can do something like measured boot. You could also implement something like this in UEFI. But for the purposes of what's available today and what's well supported in developer kits and stuff like that, I'm going to just kind of draw that distinction between what's being done with UEFI and what's being done with TPM. Remote attestation is another TPM based feature. It allows a boot log to be evaluated by a remote system and for trust and policy decisions to be made based on the contents of that log. So you've got kind of two client pieces and one remote piece. You've got secure boot, the boot loader checker thing in UEFI. You've got measured boot, which is the boot loader and boot binary thing in TPM. And then you've got remote attestation, which allows you to take that boot log from the TPM, ship it off to a remote system and for that remote system to be able to decide whether to trust it or not. Support for UEFI and TPM is spotty in legacy hardware. But it is growing particularly on the PC side. Support for these technologies in the mobile side, which I think you probably agree is probably the relevant conversation right now, is still pretty difficult to predict. Microsoft is pushing them, for example. Support for TPM in Windows 8 is, I believe it was publicly announced in, you know, the Windows 8 executive blog or whatever several months ago. I believe it's going to be standard. So that's good news if you're someone like me who works in this space and you want to be able to provide these services as an integrator to a lot of different companies and customers. But the jury is still out on whether software developers and startups in general can count on having these capabilities in the top to your mobile devices. And for that, I'm basically kind of lumping in a lot of different devices, you know, including like the tablets, you know, the new tablets coming out, the Windows side, as well as the Android side and of course the mobile phones. And the iPad. Nevertheless, given the bring your own device trend, the BYOD in enterprise IT, employers are pushing for new capabilities that allow them to protect corporate data while lowering hardware support costs. So I do believe that this stuff is very relevant. Complicating the fact is this whole consumerization trend is kind of throwing a whole wrench in the works about trying to do enterprise stuff on what is essentially designed to be consumer hardware. So that's kind of the gap that we're in right now. Microsoft has announced as part of their Windows 8 hardware certification requirement for the ARM platform that UAFI Secure Boot is required, that it cannot be disabled, and that all bootloaders must be signed by a certificate chain that they control with VeriSign. Are there any theories about why Microsoft has chosen to go that route? I actually don't know. I used to work at Microsoft several years ago. Really I kind of wanted to get you guys riled up a little bit. I could speculate a little bit, and I will. I think that Microsoft's gamble on the Windows 8 tablet, particularly on the ARM side, is kind of a long shot for them to break into the consumer space in that way. It's clearly a space that's dominated by some other players. Apple comes to mind. Microsoft is way out of their element in that space. And nevertheless it's something that the company really has to be successful in. And so should I be surprised that they're trying to lock down the hardware to control the experience as much as they can, to control the whole app store story and all this, you know, all the spaces that they're trying to play catch up in? No, I don't think we should be surprised. Furthermore, I think the Linux community and Microsoft are kind of like this old married couple that they can't live without each other, but they really don't like each other. And I think that that's kind of what we're seeing playing out right now. I think that if you're an integrator in this space, you're going to find that the UEFI boot lockdown really isn't much of an issue. It's something you're going to be able to work with and work around.  But, you know, you can buy certificate and you can work around it. That's kind of my take on the situation right now. If you want to experiment with UEFI, check out the open source Tiana Core project sponsored by Intel. There are others. Actually, if you saw Jonathan's session before this, he gave several examples of UEFI and BIOS toolkits. Anyway, the Tiana Core guys have provided lots of helpful introductory documentation and it allows you to skip having to read hundreds of pages of UEFI standardization documents, which of course is very welcome. Microsoft has provided some documentation as well, particularly talking about the new Windows 8 hardware certification kit and that explains the new bootloader signing process. And I also want to point out that the major Linux distros have done a great job of coming forth, you know, with kind of their rationale about how they're planning to play in this new world order with OEMs, particularly on the arm side, having locked down bootloaders. You know, the Linux guys have really explained very clearly how they're going to provide distributions that work and how the community as a whole can still work within that framework. So it's an unfortunate speed bump that affects everyone, quite frankly. But nevertheless, you know, you can still play ball. So I've already alluded to this several times. The big drama about Windows 8 and UEFI secure boot is that Microsoft has stated that OEMs must configure secure boot as mandatory on ARM devices and that it cannot be disabled by users. Even on X86 platforms, UEFI secure boot is expected to be on by default. So a legitimate, another legitimate concern that's been voiced is that, okay, X86, we can still turn it off, but geez, have you ever tried to navigate the BIOS prompts on a typical laptop, for example? And that's assuming you can figure out the key to get to the BIOS, you know, at boot to get the BIOS in first place. I was trying to set up my HP laptop to do some UEFI demos. Honestly, God, I work in this space and it was very challenging. It's just a real pain. In fact, when I finally got Windows 8 booting on that machine in UEFI boot mode, the TPM wasn't even visible anymore because there was a conflict in the BIOS driver. So let's hope that the newer systems have this worked out both in terms of support for the devices, but also in terms of maybe some more user-friendly prompts at the BIOS level. Fingers crossed. As I pointed out, the major Linux distributions have announced that they'll be providing signed bootloaders. Unless you plan on doing custom kernel work, I think this is really going to be a non-issue. If you are going to be working in that space or if you do work in that space, you're going to have to evaluate these options that I've listed here. So switching gears. In review, UEFI secure boot allows you to control at the firmware level what bootloaders are allowed, but what if you want to make more nuanced policy decisions and extend them higher up the boot stack? So for UEFI, we're basically talking about the BIOS and we're talking about the bootloader and that's it. Even better, what if we want to make authorization decisions on a remote banking service to return to the James Bond example based on boot measurements made on the client? What level of trust can that service place in those measurements? Oops. There we go. With measured boot, starting at the BIOS, and by BIOS I mean UEFI or legacy, before each next component in the boot chain is loaded and executed, the previous component computes the hash of the next component on disk and stores that hash in the TPM. Data is stored in the TPM in these platform configuration registers or PCRs. So if you see on the left-hand side of the diagram there, starting with the BIOS, takes a hash of the bootloader, which in Windows is for example bootmanager.exe. So it hashes bootmanager.exe, I should say Windows 8 specifically, sorry, hashes bootmanager.exe sticks that hash in the TPM, then it hands off control to bootmanager.exe. Bootmanager.exe launches either win load if it's a clean boot or win resume if you're coming out of hibernate. And then those launch the kernel. Each one along the chain is storing the hash of the next. The kernel then does something a little bit special and fancy in Windows 8. Before it initializes the early boot drivers, it loads them into memory and then it initializes a special new anti-mower driver called eLAM, early load anti-mower, that basically is an opportunity for your anti-mower solution to have a hook very early in the boot process. It can look at the hashes of all those drivers that have been loaded but not executed yet and determine if it doesn't like any of them. And if it doesn't like any of them, it can either you know, break your machine, which probably aren't going to do, or it'll let you boot and then for example invalidate the trusted boot signature. And we would also hope that assuming it hasn't been totally owned, which if it's a bad driver, it probably has been, anyway hopefully provide some sort of notification to the user via the user mode component of the anti-mower solution that you know, they need to take some action, which unfortunately probably boils down to flashing the machine. But anyway, at least this is forward progress so to speak. After boot, and I'll go into a bit more detail about how that works. After boot, a boot log can be retrieved from the TPM. The log includes the boot image hashes. It includes code signing information. So you don't have to just trust and for example keep a white list of hashes. You can also for example track cert chains. So you can decide, okay, well I trust the Microsoft certificate chain. I trust the OEM certificate chains for the machines that we use, you know, the HP one, the Intel one, et cetera, et cetera, et cetera. At least it's a slightly smaller list than of course the hash of every possible early boot driver. And there are probably going to be thousands of them. And the log includes other boot metadata. I'll give some examples shortly. Importantly, the TPM can also sign the log with a special purpose attestation identity key or AIK. So then remote attestation builds on measured boot. Remote attestation works like this. The client device shown on the left hand side of the diagram here gets turned on and it runs through the TPM based measured boot procedure that I just described. Then some client application that wants to perform remote attestation retrieves the signed boot log from the TPM and sends it to the remote server for verification. The remote server verifies that it trusts the TPM key that signed the log, that the log hasn't been tampered with, in other words that the signature checks out with the hash of the log, and then it trusts each of the boot binaries in the log. So for example, it either whitelists those hashes or it checks the signer of each binary and makes sure that it trusts those signers. Then again, in taking a typical line of business scenario, the remote server sends back some sort of signed token. Then the client uses that signed token to, for example, in the mobile banking service, for example, the client would then send that token to the mobile banking server and then the server would make authorization decisions based on what's in that token. So the assessment could be low, medium, or high security or just yes it checked out or no it didn't check out. As a result of which you can or can't download the sensitive data, you can or can't make a funds transfer, etc. So obviously there's a fair amount of complexity here. And there's plenty of things that can go wrong and I'll talk about several of those things that towards the end of the talk. In the meantime, I think that some demonstrations about how this can be used in real applications will help make it a little bit more concrete. First, I'm releasing my new measure boot tool which allows you to view the trusted platform module boot data and identify risks such as, for example, unsigned early boot drivers. The tool implements basically the following. It establishes a new attestation key based on a simulated database of trusted TPMs using the endorsement key which is the permanent encryption key stored on the TPM.  That laptop, assuming it does have a TPM, it's one of the enterprise class laptops, it already has a key burned on to it. And with most but not all of the OEMs, that key also has a certificate associated with it. And so you can decide, well, we trust the Sony endorsement key certificate and therefore we trust that this is in fact a TPM based key. So again, measure boot tool kind of shows you how to do that within the Windows 8 API that supports this stuff. The tool then produces signed log using this new key and it will format the boot data for human consumption, basically dumps it out in XML. And then it flags certain risks just kind of as some examples of how to parse that XML. It flags risks such as unsigned early boot drivers. So I'm not sure how illegible that is on the big screen, but anyway this is some sample output from the measured boot tool. I ran it on that HP laptop I just mentioned with the Windows 8 release preview build. And there are several things to note in the output of the tool. First, there are two items at the beginning of the output extracted from the boot log metadata. Actually, I guess you probably can't see my pointer on the screen. Anyway, the first thing is that disk encryption is enabled with a hardware based key. That's important because, for example, you could make with high assurance decisions based on whether you should allow sensitive data to be released to this machine because it does or does not have an encrypted disk. I'll give a more concrete example of that in a moment. The second thing is that the latest boot integrity features in the boot loader have been enabled. This is really important if you want to use this scenario on Windows 8. You want to enable these new integrity features otherwise you basically don't get anything in the log. You just get the TPM stuff, which is pretty terse. The second thing to note is that there's a really long list of early boot drivers. Keep in mind this is not all of the kernel drivers that boot with my laptop. This is just the early boot drivers. There's like 50 of them. This is a significant attack surface. We'll get back to that. The final thing to note is that if you see, let's see, well unfortunately I can't see that far, but anyway about a third of the way down you see this wdboot.sys. It's marked with elam and it says signed. That's the built-in elam driver that Microsoft is providing. WD probably stands for Windows Defender. That's their free antivirus solution. So anyway, as the other antivirus vendors start to provide these drivers, here's an example of how you can look for those in the tool output and again perhaps make decisions on whether you trust that this machine is secure based on the fact that the antivirus solution is up to date. In introducing measured boot tool I mentioned that it creates a new trusted attestation key on the TPM before extracting and parsing the log. Creating the attestation key and establishing that the TPM is trusted is a foundation of remote attestation because without that the remote server can't trust that the boot data it receives from the client is secure. So that's part of the boot strapping. We have to make sure that we trust this key. It's a new key. It's bound to the TPM otherwise everything that happens thereafter is suspect. Measured Boot Tool demonstrates this kind of whole crypto song and dance feature that I'll show a diagram of in just a second. Basically it entails establishing remote trust and simulating the data exchange between a measured boot client and attestation server. So instead of having a real client server I just kind of do you know client call, server call, client call, server call in the code. So this diagram shows the client and server messages that are used in TPM remote attestation. In other words this is what the client device does in order to transmit a boot log to the attestation service in a trusted way. First the client requests an attestation knots. The sequence assumes that the server already has that database of TPM and door stamp keys or you've gone through the trouble of you know making sure that you know all of the OEM certificate chains. So you have the Sony chain you know the HP chain etc. That way you can determine that the endorsement key public that you're receiving from the client is trusted that you know that's actually a TPM base key and not just something that the client created in software. Next the client requests an encrypted challenge. This request includes some binding information from the TPM regarding the new AIK. What the client receives from the server is an AIK certificate sorry yes an AIK certificate with an encrypted signature. So again this is kind of some of the crypto voodoo where the endorsement key can only be used for decrypting another key. And so the way that the server is going to ensure that a this is a new attestation key and b that it actually is an attestation key bound to this TPM and not in software somewhere is it's going to encrypt the certificate for the attestation key this new certificate that the service is sending back. It's going to encrypt it so that only a TPM can decrypt it using its endorsement key. So in the next step when the server sees a request coming with that new certificate it knows that the client decrypted that certificate and therefore it knows that it used a TPM to do so. If the client doesn't come back with a valid certificate then you know can't play ball not secure. So finally the client requests an attestation knots this knots like the previous knots is used to ensure that it's a new attestation key this knots is used to ensure that the previous boot log isn't being replayed. Finally the client uses the agreed attestation key and the attestation knots to produce a signed boot log that is sent to the server for verification. So again there's some complexity here obviously including some cryptographic steps that are easy to get wrong in fact several that I did get wrong and I need to fix in the tool. Nevertheless remote attestation gives us a powerful tool to ensure that the compromised client devices can't access sensitive network resources. I should clarify the previous comment. What I got wrong in the tool is I don't actually show the step of encrypting the certificate. There's no like PKI part component of the pool of the tool right now. It just kind of the low level symmetric key crypto so there's some additional steps that you'd have to do to integrate this into an existing enterprise PKI I think is how it would typically be done. Okay so back to the mobile banking example again let's look at the current state of affairs for performing security checks on remote devices and identify where there's some gaps that we can start to fill in with these technologies. The question is how can we use technologies such as remote attestation to raise the security bar in the bring your own device scenarios. Doing it in a standards-based way without imposing too much of a burden on the user. In addition we also want to demonstrate that devices can be authenticated using hardware based trust in a way that is seamless to the user. Otherwise let's be honest nobody's going to use it in particular when we're in this kind of consumerization shift here. OEMs, hardware manufacturers, handset carriers are going to be super super sensitive about anything that you know scares off users and of course security bars have a reputation for scaring off users. So what we wanted to show in this demo is a way that you can really raise the security bar on a mobile device without any additional hurdle for the user so to speak. This demonstration starts with a mobile banking application. Unfortunately I couldn't get access to the kiosk from Casino Royale but at least this application is real. In this screen notice that the bank is able to present the user with promotional offers before there's been any sign-in experience. So again this is kind of talking about well what can we do to make security convenient in a sense. This is important because it actually helps to maximize revenue opportunities. So I think this is a way to kind of sneak some of this stuff in so to speak and make it palatable to the people that we're going to be dependent on to get these technologies into users hands. After the user clicks the sign-in button they're asked for the existing logon information for online checking. Since this is the first time the app has run we want to bind the device to the user. For this demo we assume that the bank already has the user's mobile phone number from the initial in-person proofing when the account was set up. What we'd like to be able to do is bind the device to a known TPM, specifically the endorsement key like I was just discussing, as shown in the remote attestation flow that you saw previously. Unfortunately few smartphones have TPMs. Still there's an opportunity here for OEMs to raise the bar. I think partially depending on for example how Windows 8 does with their tablets we could see that change sooner rather than later. If they don't do well it's going to be later. In order to bind the device to the user the bank sends a text message with a one-time pin. The user enters that pin along with their existing username and password. And again this is kind of for the one-time device setup. Now the user has read-only access to their checking account. The account balance information is visible. However in order to transfer money we want to do this additional security checking. Namely behind the scenes we're going to gather information about the device and send it to the back end, in this case in the form of SAML claims. We did this as a demo for RSA this year. So we kind of wanted to get as many you know standard security grab bag three-letter acronyms as we possibly could. In the version of the in this version of the demo the device firmware is out of date. Therefore the banking web service doesn't trust that the device is operating correctly on behalf of the user. So this risky transit transaction namely funds transfer is denied. And of course this is the part where the user does start to get a little bit frustrated. But again you know there's a trade-off to be made.  The challenge is though is that without the hardware root of trust provided by a technology such as TPM remote attestation the banking web service can't trust the client application, can't trust the operating system, can't trust the device itself that they're really acting on behalf of the user and haven't been compromised. So now I'm going to demonstrate a real line of business application with measured boot and remote attestation integrated. So this example deviates somewhat from mobile banking. Instead it shows a purchase order application. Basically a purchase order approval system. When the app launches in the background a boot log is being generated and signed using the hardware protected key stored on the client device. So it's doing TPM remote attestation in the background. The signed boot log is sent to a web service for verification. Device integrity information is then available to the purchase order web service in the form of again SAML claims. So in this scenario that I'm showing here in this screenshot boot log verification was successful. So the next step is to authenticate the user. This is again being done you know we're going for kind of this grab bag of standard security technologies here. We're using an X509 certificate with a private key protected by the same hardware chip that signs the boot log. So there's no separate credential to carry. It's kind of like a virtual smart card that's bound to the TPM on the device which I thought was actually kind of another cool technology to show off here. Device and user authentication both succeeded so purchase orders can now be submitted and approved. Okay so this is the good sequence. But now suppose that the user gets fired. We want to ensure that this device can't make another request to the web service until the device is reprovisioned for another user. Thus not only do we want to revoke the user credential when an employee is terminated for example we want to revoke the device itself. And we can do that because we have this database of endorsement keys. So for example in the SAP job that kills a user account that terminates a user sends their last check etc. It calls over to the other system where our endorsement key trust is maintained. And it says this endorsement key is no longer trusted. So the next time this machine regardless of who's logged on to it tries to connect to our service it's not going to be trusted. Rote attestation is going to fail. We're not going to trust the boot log. Similarly of course if a trusted key but a tampered uh you know a tampered with boot log showed up you know we wouldn't allow the authentication there either. And importantly of course the user would have to be given remediation instructions. Uh again remediation when you have a root kit installed has become a little bit of a tough one these days. Cause um yeah reflash the machine is one thing but now we're not even sure if that's going to do it. Anyway I don't have the answer to that one yet. So recall that I just mentioned that the measured boot log includes additional boot metadata beyond just the list of early boot drivers. Want to give an example of how you can use some of that other metadata. A third scenario that really motivates then the use of remote attestation is access to corporate and government data by trusted insiders. In this case we want to ensure that only users with trusted client machines and encrypted disks can download sensitive files from the document repository. Sharepoint. By enforcing disk encryption and hardware identity we help decrease the chance that data can be recovered from a lost or stolen device. So again I think that this is a classic uh you know bring your own device scenario where you know your executive goes and buys a new iPad or Vio or whatever at Best Buy. And uh he or she's traveling right now so she you know she can't go into the office for provisioning and she needs access to the Sharepoint. So we can do all this bootstrapping based on a priori knowledge um you know again of the of the Sony signing key or of the Apple signing key. And um you know we can get her up and running. From the boot log we receive from that device we ensure that when she downloads um you know the financial predictions for next quarter or you know whatever sensitive data and then she leaves that brand new machine in the back of the taxi cause she's in a hurry she gets out that we know with high assurance that that machine had hardware protected disk encryption enabled. And so at least we are reasonably certain that without cracking the disk the disk encryption that document is protected even though the device has been lost. And again we can do that without that user even having to come into the office. So that's why I think that some of these technologies are really compelling if we can get them integrated in a kind of user friendly way. Okay so let's talk about the weaknesses. TPM measured boot and UEFI secure boot are important endpoint security technologies but there are weaknesses. I've already alluded to several of them. Still at a high level I think that there are two important things to keep in mind that kind of summarize the rest of the weaknesses so to speak. First we're still generally assuming that the user is an ally. For example that the user won't go out of his or her way to physically compromise the device. Your body like mine may be like rejecting that concept that we still have to trust that the user doesn't want to compromise the device. Unfortunately if you saw Jonathan's talk before mine he made it fairly clear why we still have to trust the user not to compromise the device. Because for example the user could cut the chip off of one device and wire it on to another one. And you know what does that mean now? It's still a trusted TPM but it's not the same computer. Do we care? I don't know. Secondly as I've demonstrated there's complexity here and in software increased complexity means increased bugs. That's just the way it is. So with these two things in mind this slide lists some other specific weaknesses to be aware of. First the UEFI on the UEFI side the toolkits are evolving rapidly. Lots of changes being made to the sample code for example in Tiena core. Again you know just from somebody who's done software for a long time you just kind of become nervous when you see a lot of changes that just generally means bugs so you just got to be careful. No different on the TPM side you know there's plenty of complexity and risk there as well. I talked about the risk on the TPM side of initial bootstrapping and provisioning unless you can for example get a database of known TPM keys of known endorsement keys from every OEM whose hardware you're going to support then you have this problem of determining upfront the first time you see that device do we trust that it's a real TPM that we're talking to. What we've actually done for a recent project since we haven't been able to count on the OEMs for on all of the OEMs to support that is for example in deployment where you've got a higher value user credential already deployed like for example you know OTP fob or a smart card you kind of have this moment of trust transaction where the user signs the device into the system for the first time and you say okay Mr. User under penalty of a slap on the wrist you know does this machine still seems secure to you and I admit that that is totally weak but again it's just kind of until we can get to the point of having a trust chain from all the OEMs we're kind of just kind of doing the best we can. Integrity of the TPM hardware I mentioned that of course you can there's no way to know that the user doesn't have a TPM for example instead of attached to the motherboard that is just hanging off you know the USB port or that it wasn't cut from some of the devices soldered into this one we just can't know that. Kind of a big one that that I didn't realize until I'd been working with this technology for a while is that the hibernate file is unprotected so to clarify that measured boot only happens when the device is doing a clean boot. Keep in mind that when you're doing a hibernate you're basically the kernel is basically taking this whole image of memory of all the drivers and it's just copying on a disk and when you do a resume just copies that whole memory image that whole image back into memory and then presses the big green go button so it doesn't reinitialize the drivers. Drivers can be notified of a hibernate but it's not the same as being reloaded and re-initialized because they're already loaded. So what that means is that if you have a malicious admin on the other side the admin could for example inject drivers into the hibernate file or it could modify images in the hibernate file. The only way to protect against that is A trust the user and B we would recommend of course using disk encryption because again disk encryption at least prevents the hibernate file from being modified offline. Let's say it reduces the chance. The other thing I wanted to mention two more weaknesses I wanted to mention. There's a trend of migration from hardware to firmware. I mentioned at the beginning the system on a chip approach that basically most of the tablets are using. I can't necessarily say that it's more secure to have a TPM and a separate chip than it is to have it integrated as a secure execution environment with everything else going on in a single chip. My gut reaction is that it raises a few concerns that you know that code would be accessible from other less trusted code running in that same environment. Again just something to think about. And the final item is that you still have the inevitable zero day patching delay and you know the whitelist maintenance even if you're going the route of you know just checking the certificate chains for each of the binaries. You know in a remote attestation scenario. You still have this issue of well you could have a signed binary out there that hasn't been revoked yet. You know because somebody just said this system doesn't take away that zero day risk. Looking forward from my perspective as a security software integrator there are two questions. First Windows 8 has excellent developer support for the technologies we've been discussing. And you see similar in you know SDKs for on the link side as well. But I'm particularly interested in you know will the Microsoft tablet strategy be successful because I think it's a bell weather for whether a lot of these technologies will be adoptable. And second will similar features become more widely supported on the top smartphones and tablets. Either way as I've demonstrated capabilities such as measured boot are already present in most enterprise class PCs. So my recommendation is don't be like James Bond. Protect the endpoint, choose a strong password and get the girl. I think I do have time for questions. Yeah I have five minutes for questions so I'm happy to if you don't mind voicing them out loud in front of the whole world I can take them now. Joan in the green shirt I think. Yeah so planned obsolescence about mobile devices in the in the firmware version check that we had in that in that mobile that mobile application. Yeah and in fact I particularly sensitive that because I'm the kind of person who uses a thick case when I buy a phone and so my phones last forever. And yeah this is clearly something where there could be a disconnect I think I'm getting at your point there could be a disconnect between the phone and the phone. Yeah so the phone has their own life cycle. The producer of that application which probably isn't the bank and has their own life cycle and the carriers and the operating system manufacturer none of those four entities are whatever are going to be on the same timeline. Yeah I don't have a good a good answer for that. I think that there definitely would be some issues there. In the front please. Yes thank you for being used. When you're doing remote attestation you're using the attestation identity key to sign the boot log. Typically you'll be using the endorsement key to establish a new attestation identity key every time you do that. Thank you. Right here? Yes yeah thank you. So question about denial of service so I think that there are a couple of issues to consider there I think it's a great point in general to use kind of the enterprise scenarios most enterprise systems are not robust against denial of service so that's pretty much the answer to your question there I just want to point out attestation is something that we're proposing would be layered on top of an existing authentication solution an authorization solution so you wouldn't be preventing the machine from booting and you wouldn't be preventing the user from say opening up their browser and going to google what you would be preventing is in the current flow where the user tries to log on that we're going to be doing before we let them log on to their SharePoint server so you could DOS SharePoint you could DOS whatever our logon solution is and yeah now you could DOS the attestation server as well that's absolutely true yep please yeah yeah great question question about and I should have mentioned I should have referenced this question about ARM trust zone being adopted as kind of the mobile right now the direction seems to point to arm trust zone for for you know my company does about 90 percent of our work on windows if that wasn't already obvious we have some important revenue that comes from interop between windows and linux though which is why I'd like to see a variety of devices and solutions be available it's inconvenient if you have to do the same thing twice to get it to working on arm trust zone is equivalent to TPM in terms of the capabilities I've just been describing thank you okay great thanks a lot guys


Hey guys, welcome to Snowbrick Containment Zone and have you ever wondered if you're missing out on a couple of things in this game? Do not worry, we will be discussing them today. Guys if you think that this video is helpful, please put a like to it and also don't forget if you want to support my channel, please do subscribe because it helps this channel a lot. So moving on to all of the missing things that I think some of you guys haven't seen, we will start off with the recommended button. So it's actually here. I've covered this in a video for logistics if I can remember but there are recommendations here for the gun, for basic equipment, up to advanced equipment and also logistics as well. So this function is actually hidden in the view details tab of each of your operatives. So please make sure that you know where that is. Next up is when you click on the skills, there are skill icons on the right. There's a last skill here pertaining to your alignment. So if you guys are wondering where your alignment points go, it actually goes here. You just compute it on how much buffs you have already invested in this alignment. This skill is connected to your alignment. So it's like a passive skill so you don't have to worry on how to activate it. Just contribute alignment points to this one. So next up is going to be something that you haven't, I think you haven't seen. Some of the operatives have a quick ultimate, whether you switch out or stay in. This just simply means that you have to set whether you use, when you use your ultimate they will stay in, they will not go out and swap out. So that is just what this means. So make sure that you set this as your preference, not all of the operatives actually have this. So only if you have this, just make sure that you set the right one, especially if you're bringing that particular operative. Okay, so if you guys are looking for something like for example this one, hydrocarbon plastic. If you're wondering where to get this, don't forget to click on this to check on the source, to check on where to farm it so it will redirect you to the content where you can farm that sort. That's just very simple. Some actually forget about it. And also let's go back to your storage area. There is a recycle function guys for both your weapon and your logistics. So start off with weapon. If you click on the recycle button, it doesn't say no items available because what it only recycles is blue and green that have been leveled up. So if I have a level 10 here, blue or green, then I could recycle it so on and so forth. As far as logistics is concerned, the logistics part, if you click on this one, it can recycle anything with a zero modification. If it's equipped, it won't recycle and also if it has been enhanced, it won't recycle as well. So please take note of that.  Okay, so moving to, if you happen to, let's say, if you want to clear a specific stage, usually this is a hassle guys scrolling here, right? Looking for what is a possible drop. So don't forget there's an icon here. If you click on this, it opens up all of the drops that is possible for that specific stage. Also we'll go to one operative here. So let's have life an example and her weapons. So if you want to go to parts, so the parts here have locked modifications if you remember. So actually I think some of you guys have been wondering how to unlock these. So if you click on, some of them will be unlocked through the main story missions, but some of them will be unlocked through this one. So obtained after leveling ionized jellyfish. If some of you don't know what ionized jellyfish is, that is actually a gun, a gun, a, if this is a submachine gun. So definitely your ionized jellyfish is also a submachine gun. So you have to level that gun up to level 50 even though you're not using it just to unlock a specific, a specific, what do you call this specific part? So make sure that when you unlock a specific part, you really need it like for example, if I'm going to unlock a muzzle here, this muzzle right, silencer. So this one, if I want to unlock this because of attack 12, I have to look for this particular weapon to raise it up. Do not just open anything because I'm sure you'll only be using one silencer. You won't be using all of it. So please make sure that you unlock what is only needed. And also guys, last on the list, let's go to my darling here, darling, she got lost. My darling Akasha Kaguya. Okay, so let's go to her weapon and go to train. And if you modify, usually you'd require a copy of the gun to modify, right? So if you click here, I don't see any copy here. The only reason why I don't see a copy is that when you go to storage, I do have a copy here, but it's locked.  Then there it is. You can actually click, you can actually modify once the gun is unlocked. So I just don't have any cash or credit. So that is why I cannot modify it at this point. So there you go, guys. Those are the things that I think you missed. So at least now you'll be able to remember those small things that will really help you and could probably unlock some of the things that you need to unlock. So thank you very much, guys, for staying this far. Take care. Stay safe. This is The Warden and I'm out of here.


ibility within the working day to take lunchease for example when works for individuals to be able to go for those walks our staff I know that one of our staff members for example tends to start especially in winter tends to start a bit earlier and finish earlier in the afternoon so that they can still go out and access runs and walks within because of safety in light hours as well so just offering those flexible approaches to working is really important and encouraging the overall well being of women and men in employment situations but specifically around being able to access sport and exercise. It's just really key that we tackle those big structural things as well as those individual behavioural things and that comes down to the planning side but also comes down to that employment side too I think. We now have a final theme on inclusivity which we've touched on throughout the whole morning but we've got specific questions from Paul O'Kane. Thank you very much convener and I suppose with all of this theme it's the intersectionality I suppose of issues that impact you know women and girls in sport and of course there are various areas which were covered in your report but I suppose I'm particularly interested in LGBTQ plus young women in particular and around their access. I mean how you know how do we support those women to feel secure supported safe in sport and you've touched on this already but I just wondered if you wanted to add anything. So I think in relation to the LGBTQ plus community there's a general need to reduce stigmatisation and that kind of goes without saying. We found in our survey there was some feedback around changing rooms for example and that we need to be reducing the stigma for lesbian and bisexual women specifically around them being able to access changing facilities without that pressure from their peers or potential stigma from their peers. I think that in terms of trans inclusion in sport that's really really important as the young women's movement we are an intersexual organisation we wholeheartedly support the trans community generally but trans women specifically to be able to access those same opportunities that women will be able to access in terms of sport and physical exercise and I think it's really important to highlight the additional barriers that they will face in terms of accessing sport and physical exercise. It's already difficult for cis women to access sport and physical exercise so those barriers that trans women will face will be even more augmented and compounded because of the inequalities and the prejudice that they face across society so there needs to be a real intersectional approach taken to ensuring that they are lived experience and that their voices are included within any sort of recommendations going forward and that there are a number of organisations out there such as LGBT Youth Scotland and trans organisations that are the experts in supporting trans women and trans men in the LGBTQ plus community and those organisations should be part of that conversation to make sure that those lived experiences are really heard and meaningfully embedded. Yeah I think just to bring it back to the report as well we had 25.8% that identified themselves as being LGBTQ plus and 22% of those people had a negative experience with sport and so I think that the impact of ability to access sport is even higher for those who would identify as LGBTQ plus and so therefore it's crucial to understand the lived experience of people and understand how the services can be improved to make them feel like they've got more access. I suppose picking up from a previous about the discriminatory language we hear, clubs and governing bodies not always tackling homophobia appropriately. We've seen a lot of focus on that recently. More so obviously in the mail space to do with mail players and football in particular but do you think there is still an underlying, I think it is clear that there are issues around homophobic language in women's football in particular and stereotyping very often of women who play football. Did that come through in any meaningful way but that kind of abuse and language being a real barrier and maybe clubs and governing bodies not dealing with it appropriately? It wasn't something that necessarily came through in the report because it wasn't necessarily the focus. We were looking more at the school experience or sort of earlier than that. What did come through was an idea around female bodies who play sport and how they were abused for their bodies not looking typically feminine to an idea or a culture ideal as to what that is and I think that that's only going to be further replicated in a professional setting. I can only imagine that that's even worse there. I mean I think that with all of these issues there's so much to get into but the other question I had and I was particularly interested in would be the socioeconomic factors that affect many women and girls in sport and those barriers I suppose. Do you see that in terms of having to access materials, having to access kit, having to sports being played in a very particular way that very often is geared towards men to be quite honest and very male centric and I think we see that in so many aspects of life that everything is dealt with through a patriarchal structure. Is that something that then adds a barrier in terms of cost and in terms of being able to access different sports? I think it does I think especially if you're someone who's disengaged from sport it's very difficult to then justify if you're struggling that you need to invest in joining a club or invest in materials or resources to be able to play sport when you have thus far not had a successful time with or aren't already engaged in it and I think it also comes back to what we were talking about about the feminist home planning and the sort of safe spaces is that a lot of these community spaces are a means to access for free but if they're not safe then we're throwing up for other barriers not just in terms of women's safety but also for people from lower socioeconomic backgrounds and we're basically stopping them from being able to access sport or the ability to play sport and somewhere that's safe. I think there's a number of good examples again across Scotland so I'm thinking of North Lanarkshire local authority in particular I know that they've got an active teens like free membership for young people I think it's 11 to 16 and so we've recently seen the success of the free transport for under 22s that's on the Young Scott card so I think there's some good infrastructure already in place that could be kind of harnessed going forward to ensure that like young women especially under the ages of 26 in terms of having that access to young Scott card could use in terms of like free access to leisure facilities or free access to gyms and also just in terms of that awareness raising around yeah like Katie was saying around using parks and green spaces and there's a lot of community organisations that are offering free sporting opportunities or free you know fitness opportunities but it's a lack of awareness and a lack of understanding so there's a kind of yeah I really need to kind of increase that campaign and you know public health messaging around you know where can women access this in terms of like new mums is there stuff that could be put in the baby box initiative for example that says this is how you can get back into sport and fitness and so yeah and you touched on in a previous answer that potential for you know gym classes and sports activities to become accessible with a childcare element attached to that I mean do you feel that something that's important as well to create I suppose more flexible options for people and being able to you know work sport into their life rather than the other way around yeah absolutely I think we've seen recently that the cost of childcare for young for young mums for any mum for any parent actually have significantly increased and we've I think it was a poverty alliance did some research around the impact on young women in generally around the cost of living crisis and how they're taking on a lot of the kind of the brunt of childcare and that will certainly impact their ability and their capacity to then be able to go and take part in in sport so having accessible childcare options within leisure facilities within kind of sporting clubs or being able to take part in like baby and mum or baby and parent like you know classes is really important to kind of reduce that barrier. I want to ask about disabled women because you know we've been yesterday from some of the sports bodies we had representatives from disability Scotland and talking about some of the barriers that women who are disabled faced in access and physical activity in sport not just you know at the drop-out points but throughout throughout their their young and adolescent and then into the young womanhood as well was that anything that you you got any evidence on? We did we spoke about protected characteristics and disability was part of that I don't again I think it was it was one of the areas where we didn't get a significantly high enough response to make any kind of huge claims about that on it. I think it goes back to yeah what we're saying about like similarly to the other protected characteristics it's about young women with her face and disabilities being part of that process and having their kind of voices embedded within that to co-design and to share their feedback in terms of research about what works for them and what doesn't work for them and maybe more capacity building and training for for coaches for teachers for youth workers around how to meaningfully support young women and women with disabilities within a sports setting and how to make that an inclusive and welcoming and safe spaces with their voices at the centre of that and I think that's just it's kind of it should be kind of standardised across all the protected characteristics it's just ensuring that that lived experiences is heard and meaningfully kind of involved in the the process. Designing things with people rather than hearing the issues after things have been structured. Sandesh you have a question on this. Two brief questions the first is about periods so Beth England was talking about it and talking about how it affected her when it came to training how she felt washed out and obviously if we talk about girls and young people they've not grown into their body they don't really know about it so what has your report said about how periods affect girls their participation in sport but also what we can do to maybe help? Yeah I think at the time we spoke a lot about period products being crucial for access to sport and feeling comfortable to play sport and feeling supported one thing we also spoke about was the lack of diagnosis for things like endometriosis when especially young girls are in a lot of pain as a result of health conditions and don't necessarily know their bodies well enough to know when something is not necessarily normal and the amount of pain that they are feeling or the impact that that's having on their ability to exercise or engage in sport is really troubling and they don't necessarily have the language to communicate that in a school setting or to teachers and perhaps even not as enough awareness around those menstrual issues with teaching staff as well who are having to to provide you know plans or programmes for exercise and also you know I think that's something that's been there's been more aware awareness of now is how your cycle affects your ability to interact with different levels of exercise and how you should probably be catering your training and your sort of level of exercise based on your cycle once you've got an awareness of that but I think as a young girl that's something that you don't necessarily have enough knowledge or resource around and one of the recommendations that we made was having a space for young women to go and have really clear public health information around the changes to their body around impact that their periods could have and I think probably linked to how that may be affecting their moods and their energy levels and their fatigue and I think having somewhere that I think in a school setting when you're having that sort of education and you're in a class full of people it can be really uncomfortable to ask difficult questions or to feel like you're not experiencing something different to to your peers and having somewhere to go that has really clear but easy to understand information is crucial to removing some of that stigma even just in young girls themselves. Thank you and my second question is about pregnancy and earlier you had said that you'd spoken to young mothers but now if we look at elite sport and again I go back to the England women's team with Tony Duggan, the Everton player who got maternity leave and then finally there's some maternity leave being given but in general women who have children don't tend to be in elite sport and I wonder if that I know this is part of the role models but that gives us a bit of a negative image and so how can we make it more normal and how can we encourage women who have children or are pregnant to participate? I think it goes back to a reason awareness campaigns and public health messages again and ensuring that there's good practice examples out there of how women can still participate whilst they're pregnant and to challenge some of them maybe like more damaging messages around like you know if oh you're pregnant you shouldn't you shouldn't be doing sport which tends to be you know like the kind of normal narrative but actually there's a lot of evidence to suggest that if you're already active you can continue to be participated in sport and it's about that healthy advice so maybe supporting midwives, healthcare professionals, people that women that are about to have a child come into contact with around those kind of safe public health messages and awareness raising campaigns of role models who are already doing that with yeah maybe not in elite sports but actually within community based sports as well and just like yeah building awareness and showcasing good practice examples of how that's already happening. I think as well that comes back to the governing bodies and the lack of women on sports government bodies is that if you don't have those voices discussing the idea of maternity rights and taking time out from maternity at an elite level then you're never you're not going to encourage those rights to come into place and I think the more that we can encourage women into places of decision making in sport then the more those questions can start to be answered. Thank you. I have a question from Stephanie. Thanks very much, convener. Just you touched on endometriosis there and you touched on heavy periods and it's something that myself I suffered from really badly when I was younger and you're absolutely right about the fact that we're not educating young women and girls about what's normal and what they should be expecting and when they should seek support and so I completely agree with that sometimes you know it was a challenge getting through a full period in school never mind actually going and jumping about and doing PE but I suppose my concern with that as well is how do we ensure that teachers and support staff are actually listening to girls and they're taking them seriously because this is something that we hear repeatedly right through right across different different portfolios and remits is that women and girls are often not listened to so I'm wondering if there's if there's anything that you can say about that thank you. Yeah I think I think in terms of the women's healthcare generally it tends to be a subject that isn't as widely researched and especially when it comes to to kind of endometriosis periods like premenstrual dysforic disorder for example is something that a lot of like young women wouldn't have awareness of or know about and then if the young women themselves don't have awareness about it then the teachers the educators the youth workers the yeah the kind of professionals within that space might not have an awareness of it as well so I think there needs to be some capacity building and training and resources that could be co-designed by young women themselves around how they're feeling like you know a specific piece of work around young women who have been diagnosed with endometriosis for example and co-designing training and tool kits and resources and information for teachers that could be rolled out across Scotland to sort of raise awareness of the real issues of that. I could just pause you there as well I think really probably the biggest concern I've got obviously it takes you a very long time quite often to get diagnosed with endometriosis or whether it's really heavy periods which I know there is a correct name for but I don't know of patches now there but I think one of the big issues is actually around actually women and girls being trusted so they don't necessarily have a diagnosis but if they're going and they're speaking to a teacher which can involve a huge amount of courage to actually have that conversation and then they're kind of like fobbed off with or do you know what stop trying to get out with it go on with it so I suppose that's more the issue that I'm looking to get to. Yeah I think like coming from an educational background I think that there is more of a push towards understanding young people's voices and understanding and sort of taking into account how they co-design things but I think it is largely around an education piece as to the barriers that women are facing I don't think anyone or many people going into education are not doing it for the right reason they're not looking for the best interests of the children and I think that it's all about an education piece a lot I imagine a lot of people who are going to to teaching physical education have not had barriers to sport and have found that an easy route to success and I think it could be important to have adequate training for staff linked to inset days linked to local training local authority training that really educates on and how that's going to impact because it isn't just on the physical education of a child it's across the board as you say it's difficult to focus when you're in an excruciating amount of pain and to go to six or seven lessons throughout the day and feel like you're having to re-explain yourself it can be very difficult and there's certainly ways for that could be communicated in a really kind and constructive way but we I guess that's something that we have to speak to to schools and educators about to understand better. Thanks it's good to know that co-design is talking about trust and agency and Giddl's been understood thank you. Thank you very much we've kept you longer than we said we would but that's because everything you're saying has been so valuable and certainly what's been particularly valuable I think for myself and the clerks is some of the other groups that you've mentioned that you're aware of that we can pick up on as well so thank you for your time today. At our next meeting we will undertake routine scrutiny of NHS boards and then continue taking formal evidence as part of our inquiry into female participation in sport and physical activity but that does end our formal and public part of our meeting today.


السلام عليكم ورحمة الله وبركاته بسم الله الرحمن الرحيم والصلاة والسلام على أشرف المرسنين سيدنا ونبينا محمد وعلى آله وصحبه وسلم يا ربنا يا ربنا لك الحمد كما ينبغي الجلال وجهك وعظيم سلطانك اللهم افتح علينا افتح العرفين اللهم علمنا ما ينفعنا وانثعنا بما علبتنا يا أرحم الرحيم اليوم is a new day this means we have another chance to practice the ten outer actions that will get us closer to الله سبحانه وتعالى these actions which we covered earlier have given us more time more chances to get prepared to meet Allah سبحانه وتعالى so in this closing session I will try to link together what we covered during the past 11 sessions and I will start with a story and the title of this story is a chance that will never be repeated so the narrator tells us the story yesterday I went back to my home I was so tired my wife told me why you don't change and rest a little bit so the food would be ready and indeed I went to my room I changed my clothes I had a nap but it was a long nap when I opened my eyes it was the voice of the caller of the event calling for us for prayer so I went out of my room and I went to the kitchen I found my wife bearing the table and I said I took my seat on the table and I asked her what did you cook for us my dear she did not answer I repeated the question again and again but I had the same answer no answer I was so surprised I did not get angry but I was surprised this is the first time that I asked my wife something and she ignores me she didn't pay attention to me I turned to and looked to the door and I found my son Ahmed coming into the kitchen and I asked him to get me a bottle of water from the refrigerator but his response his reaction was the same as his mom I got more surprised Ahmed is answering me he's not answering me he's a very good son he is he is a very good he has the best manner going on I tried I wanted okay to leave the kitchen but I heard my wife saying Ahmed go and wake up your father so tell him to come ready dinner is ready I was really surprised Ahmed went to my room to wake me up so I called him and I said with my loud voice hey I'm here but he did not he did not look even at me and he went quickly and he left me surprised and one minute after that Ahmed came his face was telling so many things so his mom looked at him and she asked him did you wake up your father and he couldn't he didn't know what to say he he he he said I tried mom but he I tried many times but he did not answer me hearing him I was more surprised what is this boy saying I'm here what is what's this boy saying so my wife went quickly to my room and she was followed by my children they were all terrified so I followed them just to to see what's what's going on so she was trying to wake up someone else who is on my bed he looked exactly like me he was wearing the same clothes and he was sleeping the same way I do that was surprising very surprised stunning so when she when she did not have an answer when when this man did not wake up she she started to cry and my children started to cry and they they everyone was trying to call that man on my on my who is sleeping on my bed and they were just clinging to his clothes trying hoping that he will answer and I was unable to understand what's going on يا الله what's happening who is this person who is exactly a photocopy of me why no one is not hearing me why no one can see me so Ahmed went quickly out of the house and he came out a few minutes later with my father and my mother and also my siblings and everybody started to cry everyone was my mom was hugging that sleeping person on my on my bed and she was crying and crying like everyone I went to her I tried to to to touch her to talk to her to to make her understand that I'm here next to her but I couldn't nobody was listening to me so I looked at my father I turned to him I tried to hug him I tried to to talk to me to my wife to my siblings but no one was hearing me my siblings went out to prepare the gym and my father was crying he sat on the chair he was unable to stand up and I was so depressed of that nightmare what's going on I'm trying to wake up but what's going on so the the person people started to come into the house the responsible they washed the body that was on my on my bed and my children helped with shrouding the body and they put the body in the cascade friends and family all came to the house and everybody was hugging my father who was crying and they were giving him condolences and they were giving condolences to my siblings to my children to my wife and they were they were making doha for mercy and for to be patients also the cascade was taken to the to the messaged so no one was left in the house so I went immediately froming after the journalism so everyone so everyone everyone everyone came to the Genaza they all everyone came to the masjid they lined up after the Imam and it was obvious that they are going to pray on me so I was it was so crowded but I was able I was able to get into between the lines easily without touching anybody the Imam started the prayer and I was calling everyone hey I'm with you you cannot you don't feel me I am I am calling you you don't listen to me I am with you you don't you don't see me when I do not have any answer I went to the cascade I opened the cover and I looked at the man who was sleeping in there when I opened when I opened the shroud he opened his eyes and he looked at me and he said my turn is over I am my life is done but your life you are starting the eternal life I was with you on your life but today I am going to be buried but you are going to go to have a break running I couldn't do anything I found myself in the cascade nothing was helping me I am unable to see anything I am unable to move I am unable to speak I was just listening to the Imam finishing the prayer and then they took me to the graveyard and I was put in there in my grave and then they started to pour soil on me and then I heard footsteps of the people leaving the way at that time I realized it was the end maybe it was the beginning of the end but I had meetings I had a lot of work to do I had some debts that I haven't paid back to people yet I want to write my will I want to do something good I want to command good I want to forbid evil and suddenly slowly I heard footsteps coming towards me oh my god now my deeds will be estimated these should be even Karwanakir they are coming to me and I was I was shouting I was calling رب يرجعون رب يرجعون رب يرجعون لعن لي أعمل صالحة فيه ما تركت oh my god send me back oh my god let me go back so that I do righteous things I be a good one I'll be a good Muslim but no one heard me and nothing happened while I was at that moment I heard my little baby calling me بابا food is ready so I opened my eyes and I found my younger sister my younger daughter just waking me up so to go to have dinner with the family for a second I was I was just getting myself back again and I was sweating and I said to myself hey my nefs hey my soul you are back so let me see what good you are going to do after today it was a waking up dream I was given another chance this time I was given another chance but when it's time for me to leave this dunya I will never have another chance so I was given another chance and I promised myself not to lose it I promised to establish my prayers to pay صدق to pay the cash to help the needy to fast to fast the month of Ramadan and to fast extra days during the year to perform hajj to have a daily word of Quran to go to thicker gatherings to seek lawful to be good to all creatures of Allah I promised to command good and prevent evil and I decided that I will follow prophet Muhammad صلى الله عليه وسلم and apply his sunnah but what happens really when we die now we have a chance but when we die what happens there has been an article written by a Kuwaiti writer his name was عبد الله الجاو الله so he said when I die I will not get worried I will not take worry about my body because it's going to to vanish but I am going I know what will happen to me my my siblings and my friends my Muslim friends they would they would take my clothe they would wash me wash my body they would shroud me they would take me out of my house they would take me to to the message they would pray on me they would take me to the grave and they they will bury me my things will be given away my books my keys my bags my clothes and if my family were were to do good they would they would give everything I have as a as a so that that will benefit me life will go on my job will be given to someone else my money will be given to will be distributed among those who will inherit me even though I will be I will be asked about and repent me where did I get it from and was it lawful or not or the first thing that will that I will lose is my name because when I die they will say where is the body they will not call me by my name and when they want to pray on me they will say bring the jinnasm they will not call me by my name and when they will when when they are ready to put me into the grave they will say get the deceased so we put him in the grave they want they want to say my name so I will not I will not think of my lineage of my tribe of my people of my job of my fame these are things that are just for dunya and people they will they will be sad and they will be divided into three groups of people those who know me just by the name they will say oh he passed away miskeem my friends they will they will feel sorry they will be sad for a few hours days and then they will go back to their own life and the third group will be in my home they will feel the sorrow and that will be also for a week two weeks months two months but then like everybody who passed away life life again will go on so the story is done the life story is done but the real life the real story started it's the after it's the after you left everybody and nothing is with you except your deeds so the question now what have you prepared for your after what have you prepared for your grave so beware cling to your prayers to your pride and to the Nawafia to the prayers to the good deeds to Salat al-Lait praying at night so that that that will help you to be saved so الله سبحانه وتعالى says رب لو لا أخرتني إلى أجل القريب فأصدق this is about someone who passed away but he was not doing really good deeds in this life so he would say يا الله let me I wish you you would give me just more time so that I would go back and I would give صدق فأصدق I will pay I will pay the car I will pay أصدق he didn't say I want to go back to make Amra or to pray or to fast so this this color said the deceased would say I want to go back to give صدق because of how big the reward of صدق is so just pay pay and give صدق now we would we would ask what is is صدق just money no it's the good word is صدق smiling in the face of your brother is صدق being good to people is صدق having good manners is صدق so our life is a treasure that we should save it's like someone who said by the beach before pleasure so it was still dark and he looked around him he found a small bag filled with stones so he took the one of the stones and he throw it into the water of the of the sea so he liked the resonance of the water so he took another stone and he throw it and he kept throwing one stone after the other then light the sun rose and there was light so there was only one stone in the bag one stone left so that man looked into the stone and he found it a jewel so he discovered that all the stones that he has thrown into the water they were all precious stones they were jewels so he said oh my god how how bad I was I was throwing stones I was throwing these jewels that I thought they were just stones just to enjoy the the resonance of the water I swear that if I knew it was just jewels I wouldn't have wasted one of them unfortunately we are all like that man the bag of stones which is the bag of jewels is our life which we waste hour after hour uselessly the resonance of the water of the stone on the water is the dunya and the pleasures of the dunya the darkness of the night is the heedlessness which we live in and the pleasure of breaking the up is the reality and this reality happens only when we die we wake up when we die so our days are jewels we should save them we shouldn't waste our time we should use our time wisely so that we do not we do not feel sorry we do not we do not feel sorry when they're feeling sorry it will not be helpful so our hours days weeks months years are precious stones they're valuable stones that we should keep and not waste we have to be careful we have to take advantage of every single moment we have to use our time to gain the love of Allah SWT and we have to connect to our beloved سيدنا محمد صلى الله عليه وسلم so that he directs us to the right path that leads to the pleasure of Allah SWT we have to truly love سيدنا محمد صلى الله عليه وسلم and follow his sunnah we have to learn good manners from سيدنا محمد صلى الله عليه وسلم and apply them he says أقرمكم مني مجلسة يوم القيامة أحاسينكم أخلاقا the closest of you to me on the day of judgment are those of good manners so we have to have good manners we have to learn how to have good manners it's loving the beloved this is one of the best ways so that we are saved the non-muslims look at سيدنا محمد صلى الله عليه وسلم at our surah at our how we react in this dunya they don't look at him in his real picture so if the picture if our actions are good and they will look at him in a different way they would say these are the followers of Muhammad so we have to love سيدنا محمد صلى الله عليه وسلم same way that سيدنا آدم asked الله سبحانه و تعالى to forgive him because of his love because of Allah's love to Muhammad he says سامحني لأجل حبك لمحمد so Allah سبحانه و تعالى said to Adam عليه السلام how do you know that I love him سيدنا آدم said when I looked up at the throne I saw if I saw his name is next to your name is connected to your name and you will not connect your name to a person unless you love you love him the most loving the beloved this is Allah's love to say give the Muhammad صلى الله عليه وسلم things I loved Allah I loved سيدنا محمد صلى الله عليه وسلم when when سيدنا محمد صلى الله عليه وسلم was at Mount Uhod he said to the Sahaba Uhod جبل يحبنا و نحبه Uhod is a mountain mountain that loves us and we love mountain so love here it started by the mountain and then سيدنا محمد صلى الله عليه وسلم loved the mountain so we have to love سيدنا محمد صلى الله عليه وسلم then he will love us he cares about us yes but we want to make him love us we want to be coolness of an eye to say another another example of the things that love سيدنا محمد صلى الله عليه وسلم is the love of the trunk of the tree to say when when when this he used to stand and lean against the trunk of a tree then they decided to build a pulpit for سيدنا محمد صلى الله عليه وسلم so that he will be raised a little bit so people would see him and that would be better for the so the first time they سيدنا محمد صلى الله عليه وسلم after the pulpit was ready so he went up and gave the and all people heard the crying of the trunk of the tree he cried because the trunk of the tree cried because he felt that سيدنا محمد صلى الله عليه وسلم is away from him he couldn't bear it they built the pulpit to سيدنا محمد صلى الله عليه وسلم and that pulpit was the reason that سيدنا محمد صلى الله عليه وسلم is not leaning against this trunk of a tree so what happened سيدنا محمد صلى الله عليه وسلم stopped his he went down and he hugged that trunk and he said he hugged he hugged that trunk this trunk calmed down we all wish that we were that that trunk to get this hug from سيدنا محمد صلى الله عليه وسلم so we have to practice to practice love one time one of the wisest people was asked what is the difference between a person who just utters the words of love and a person who loves who lives love is it okay I will explain to you he invited them to big feasts and he started with those who just say the words of love but they don't know what it means actually so he when this group of people were at the table they were given the soup and everyone was given a very long spoon to eat with a one meter spoon and they were to eat this soup with this big huge spoon they tried but they could not and all of them spilled the soup and they could not eat it so everyone was hungry the wisemen said okay now look at the other group so there was another feast for those who have love in their hearts who practice love and when they were at the table they were given exactly the same spoons long spoons and they were given the soup so that so each one looked at the spoon and he took the spoon he filled it with soup and he was feeding the person in front of him so that they all ate and they were all full they thanked Allah سبحانه وتعالى so in this dunya whoever thinks of just feeding himself he will stay hungry all the time but whoever thinks of the others whoever thinks of feeding his brother in Islam his brother then they will both be full so there are steps of love steps to do before we love we have to clean our hearts and we have to shine it and then love will sprout in the heart so how would we love سيدنا محمد صلى الله عليه وسلم first of all by knowing him by following him الله سبحانه وتعالى he talked about about the real love of سيدنا محمد صلى الله عليه وسلم he talked about following سيدنا محمد صلى الله عليه وسلم obeying him he who obeys the messenger he who obeys the messenger he who obeys the messenger has obeyed Allah so we have to obey سيدنا محمد صلى الله عليه وسلم we have to know him how he lived as a husband as a father as a grandfather as a teacher as a leader we have to know سيدنا محمد صلى الله عليه وسلم we have to be in the presence of those who love سيدنا محمد صلى الله عليه وسلم because love transmits through hearts and we have to ask الله سبحانه وتعالى to give us the love of his حبيب الله سبحانه وتعالى said in surah ghafir ayah 60 دعوني أستجب لكم ask me and I will answer your your calls so when your heart starts to feel the love of سيدنا محمد صلى الله عليه وسلم then we have to thank الله سبحانه وتعالى because الله سبحانه وتعالى said in surah ibrahim لا انشكرتم لأزيدنا if you thank then I will increase you if you thank me I will increase you so what's the fruit what's the result of of loving سيدنا محمد صلى الله عليه وسلم sending salat to him and we all know that سيدنا محمد صلى الله عليه وسلم by this الله سبحانه وتعالى will give us salat in times so now we are sending salat to سيدنا محمد صلى الله عليه وسلم and said the closest of you to me on the day of judgment will be those who sent the most blessings up on me whoever sends the blessings up on me الله will send blessings up on him 10 fold and then the result of loving سيدنا محمد صلى الله عليه وسلم is gaining his companionship on the day of judgment and he says and where's and our friend also then insha Allah while loving سيدنا محمد صلى الله عليه وسلم we will be with him so loving the beloved is our call so we have to know that who we are loving while loving سيدنا محمد صلى الله عليه وسلم who is a human but not like all humans he's a human but he is the one whom Allah SWT loves the most he's a human whom Allah SWT has honored him with the banner of with the banner of thanking Allah SWT this is سيدنا محمد صلى الله عليه وسلم who is going to argue Allah SWT to talk to Allah SWT and to intercede to his Ummah so we have to strengthen our relationship with Allah SWT and with سيدنا محمد صلى الله عليه وسلم and as we said we have to make lots of dua and Allah SWT has given us certain times that that the words are multiplied this is the month of Rajab Shaaban, Ramadan the night of Israel and Miraj then the the fifteenth night of Shaaban the ten days of these these times are like a fuel station for us to get fuel that will be the sustenance for our soul for the whole year so we have to do our best during these blessed times we have to take advantage of these chances that Allah SWT has given us so with this سبحان الله we when we practice these ten outer actions that we have covered for the past eleven sessions then we will get closer to Allah SWT and we will be more prepared to meet Allah SWT when it's our death we want to be of those whose death is easy who have who die on the best land that Allah SWT loves and who die when they have their best actions have been done so with this we conclude our part one of this series and Insha'Allah we will we will have another a group Insha'Allah another session which will be part two and this part two will will focus on the heart on purifying the heart from blame or the characteristics anger envy and love of this world pride self admiration and a lot more so until we meet with our part two of this series I will send you my Salam and I will ask Allah SWT help us stay steadfast on the right path the path of that would lead to the pleasure of Allah SWT so that we will be of the winners on the day of judgment وصلط اللهم على سيدنا محمد وعلى آله وصحبه وسلم و السلام عليكم ورحمة الله وبركاته


Well, good morning everyone. I'll gavel to an open this 98th meeting of the National Advisory Council for Human Genome Research. I'm Eric Green, director of the National Human Genome Research Institute. I welcome all of you to this council meeting. I should immediately point out that this is the first time we're doing a council meeting in this exact format. Whereas we have all of our council members joining us virtually through Zoom, but we have many NHGRI staff here in our conference room in our normal location for council meetings. And this is a routine we're trying out where using the winter months of February, which sometimes is difficult travel because of weather, we'll not ask our council members to come in town and to do this virtually, but at the same time, gather here as an institute to be able to interact and help facilitate questions that come up. Unlike our other two council meetings each year in May and September, those will be fully in person with the ability to bring in council members that's needed by Zoom if they're unable to travel. So that's why there's some people here in the room, but council members by Zoom. So let me turn this over to our executive secretary, Rudy Pazzotti to make a few announcements. Thank you, Eric. Good morning, everyone. Welcome to the open session of the February 2023 council meeting. I wanna remind everyone and council members that the open session is being live streamed can be viewed going to the NHGRI genome.gov website. We will also create an archive of this meeting. There are archive meetings going back to 2011, I believe. They'll be posted on the council webpage. Again, NHGRI genome.gov. We have one new staff member to introduce, and Renee, could you bring up the slide, please? I wanna introduce Maricela Trujillo. She originally is from New Mexico. She attended college at the University of Arizona. In 2013, she moved to Maryland and worked at NIH for seven years. She moved back to New Mexico a few years ago and worked as a budget analyst for the Department of Defense at the White Sands Missile Range. She'll be a grants management specialist here at NHGRI and will be working remotely. Welcome, Maricela. I'd like to acknowledge our council society, liaison members. Ellen Giurelli is from the International Society of Nursing, nurses in genetics. Mona Miller from the American Society of Human Genetics. Matthew Kaffit from the Genetic Alliance and Rhonda Schaunberg from the National Society of Genetic Counselors. I also wanna acknowledge Janelle Glover, seated at the far right side of the table. She's a program analyst at NHGRI and she is our note taker today and will be responsible for preparing the minutes from this meeting. I also wanna acknowledge Renee Ryder, program director at NHGRI. She is managing all of the slide presentations for today and tomorrow, which is probably the definition of herding cats. So thank you, Renee. Council members, I seek your approval of the minutes from the September 2022 meeting. Are there any edits or suggested changes to the minutes? All right, can I get a motion to approve the minutes? And a second, I'm going with hand waving here. All in favor? All right. Anyone opposed or wishing to abstain? Thank you very much. Let me, excuse me, draw your attention to the future council meetings for 2023 and 2024. They're listed on the open session agenda. If you discover any scheduled conflicts, please let me know and more importantly, Comfort Brown. As of this time, we're planning for the May and September meetings to be live and we'll be in touch if there's any reason to change or reconsider those decisions. Now I'm going to yield the floor to Eric for the directors for the board. Okay.


Most of the complaints I hear about technology are actually complaints about the fact that humans are social animals. We say technology makes us distracted, technology makes it hard to focus. What's actually distracting us, what actually makes it hard to focus is that behind all of those beeps and buzzes and notifications are other human beings and we care what they think of us.