Good afternoon. I'm Paula Feldman, Director of Business Intelligence with PMMI, and I'd like to welcome you to today's webinar on flexible packaging. Over the next hour, we will listen to the findings of this report by author Donna Ritzen with DDR Communications. Topics discussed will include the size of the global flexible packaging industry compared to rigid packaging, how has the demand for flexible packaging changed in the past five years, what's driving future packaging equipment investments, and providing OEMs with an outlook of the future demand for packaging equipment. President of DDR Communications, Donna founded the company 25 years ago. DDR's business is based on a direct response methodology that delivers market research, business development, strategic alliance, and marketing intelligence to companies and virtually every business-to-business industry. DDR's experience is backed by over 35 years in marketing communications. Just a couple housekeeping notes before we get started. If you have any questions that we'd like to ask Donna or myself, please type your questions in the chat box that's located at the bottom right-hand corner of your screen. All phones are on mute so that we will not have any background noise. And at the end of this presentation, which will last approximately 45 to 50 minutes, Donna will be available to answer any questions. So at this point I'd like to hand the webinar over to Donna Ritzen with DDR Communications. Thank you Paula and welcome everyone to the webinar on flexible packaging. I like to keep it a bit informal so if there is something along the way that like Paula said, if you have a question about something specifically, certainly post that question and we'll get to it if it's right in the middle of the report, even if it's something critical. So the table of contents here, we've got this broken out into three different sections. It's structured a little bit differently than the actual report. We'll look at what the objectives were and up front we'll look at who the participants were so that as we go through the information, you've got an idea of the participants of this survey that we did. Like Paula said, we'll take a look at the future of flexible packaging, some of the trends that are occurring, how that's impacting the machine builders and material suppliers, and then taking a look ahead at what's coming next. So from the flexible packaging five-year update, we did a report on flexible packaging five years ago. So we'll look at how is the size of the market changed? How is the demand for flexible packaging changed? What's driving equipment investments? And then an outlook and some actionable suggestions for the OEMs. So if we look at one of three companies that we talk to do have future plans to use more flexible packaging, particularly in the food industry, which is the largest user of flexible packaging, food service industry, and particularly in medical devices. And the key influencers of why flexible packaging is growing is certainly the consumers we are the consumers. We tend to be buying more products in flexible packaging, but there's also the retail end that is influencing that in large restaurant chains and food service organizations that are looking for more convenience in their food service as well. Some of the things that are being looked at for flexible packaging certainly is lowering cost. Less material usage is definitely something we'll explore in the future here in a couple slides. It improved barrier properties to prevent light coming in and different things that would inhibit the integrity of the product. Reducing labor is an area where customers are looking and users are looking when they're looking at flexible packaging. In some instances higher output, but we heard some contraindications to that that in some instances it's a lower output, but certainly improving operating efficiencies wherever possible. And looking at capital expenditures in the year ahead, about two out of three companies that we talk to are making changes to their packaging line. In one in three of those companies we'll be increasing their spending on capital equipment. So we'll take a look at all of the subjects in a bit more detail as we go through this. We talked to 50 professionals in the packaging industry, mainly end users, but we also talked with material suppliers and some industry experts. We predominantly talked to food companies, larger food companies, but also medium and small companies. Food predominantly is the industry that uses the majority over half of the industry is used in flexible packaging from food manufacturers. But we talked to a good representation of beverage companies, household products, pharmaceutical and healthcare. And we talked to some of the leaders, some of the top leaders in food, in beverage, in consumer product goods in the household products area in the medical devices. And we talked to people that have a hand in and are part of the decision-making process of choosing if a company uses flexible. Are they going to switch a product from rigid currently to a flexible container? Are they going to bring a new product out and flexible? So we talked to the operations people, certainly innovations people, packaging engineers and managers, directors and designers of packaging engineers, packaging specialists, and certainly a smaller percent, but some of the procurement people that are involved in the acquiring the materials and the machines. So this next section is just an executive overview. I'll go through this a little quickly so we can get into some of the details. But we heard consistently that the decision to decide to go to flexible packaging or rigid packaging, it's really all about the cost. And all those costs need to be justified and considered when you're taking into consideration what type of packaging you're going to use. And here's some information from the Flexible Packaging Association. This is secondary research that we brought in to give you an idea of the growth in the flexible packaging market. It certainly is growing. Flexible packaging compared to rigid just took up 1 percent. It's 19 percent of the total packaging market is flexible packaging. It was 18 percent in the previous year, so it upkicked just a bit, but does continue to grow. And like I said, flexible packaging in the food industry takes over. Half the industry goes into food, then into some retail non-food products, consumer products, which would be your household products, and then some medical and pharma, and then each one from there down. Institutional food takes up just a small percentage, but that is a market that we heard is growing in terms of adopting more flexible packaging in the future. So here we compare the last five years in how flexible packaging has changed. Now the statistics between flexible and packaging on this slide are just coincidentally exactly the same. It depends on what companies we talked to, and we did talk to a handful of companies that were involved in the report five years ago. So this is not to give you an indication that flexible between rigid is not growing. 33 percent, one out of three companies, manufacturers, and users that we talked to are moving more of their products into flexible packaging over the next five years. This is just an average of when we talk to each end user, how much of their product mix is inflexible, and how much of their product mix is in rigid. And it was just a complete coincidence that both figures from both years 2010 to 2015 turned out to be the same. There is growth in flexible packaging. So if we look at spending in the next year, it's pretty much staying the same, but there's definitely been a shift since the last five years when we talked to end users. So if we look at the charts here, you can see that in 2015, that's the outer circle, and over half of the end users that we spoke to said they will be spending on capital about the same as they have in the last 12 months. But if you look at the inner circle, which was 2010, 61 percent greater majority said they would be increasing their spending on capital equipment for flexible packaging. And this does coincide with how flexible packaging was introduced years ago. Certainly it wasn't new five years ago, but it was still growing in terms of manufacturing capabilities. So in those five years, a lot of the companies that we spoke to had acquired the equipment that they needed. So if we look at the number of companies though, and I think that this tells a lot of the change in the dynamics going on in the industry, is the majority of companies that we talked to almost two out of three were making changes to their manufacturing lines in the next year or two. And of those companies who are making changes, three out of four of those companies are going to be purchasing new equipment versus trying to modify any equipment that they currently have. And 88 percent of the manufacturers that we talked to search for equipment that best fits their needs versus just looking at U.S. manufacturers first. So it's certainly a global market, which is not anything new that is being reported, just being reconfirmed in this industry as well. So we made some comparisons to predictions that the flexible packaging playbook made in 2012 with the near views that we had in 2015 about flexible packaging, and they definitely correlate and line up. The trend is certainly consumer convenience, more easy open, resealable closures, that's something we've seen in all of the food industry particularly, but certainly in consumer product goods is certainly a more easy open container, which is something that flexible packaging offers. And companies are looking for higher film transparency in some instances, particularly in food. U.S. is to follow Europe with more pouch usage. Europe uses more pouches than the U.S. It's growing, like I said, in food service, food and medical devices particularly. And in the cereal aisle, we're really not seeing so many changes. We heard some different considerations that were going on and being tested, but nothing yet to report if there's any changes moving out of a bag in a box. For the five manufacturers wanted more multi-layer barriers to extend shelf life. Certainly, there continues to be a reduction in packaging sizes. Retort is becoming more popular in stand-up pouches, particularly offering stand-up now to sauces and salsas and dressings. We see it on our shelves pretty consistently in terms of some of the new products that are continuing to come out in flexible packaging. In over half of the manufacturers we talk to are using a pouch to save on material usage and costs. And many of the products that are coming out in flexible packaging are also your larger, refillable sizes. Another area where flexible packaging is main packed. So let's take a look at the future here of flexible packaging and who's using it. Like I've said, food industry uses flexible packaging the most. These are representing the 50 companies that we talk to. This isn't necessarily an indication of all companies, but the food industry, over half of the food industries, companies that we talk to in the food industry have a majority of their packaging in flexible. Compared to beverage, it remains much more so in rigid. Compared to consumer product goods or your household cleaning products, certainly are remaining more in rigid. But that's an area where you're seeing some of the refills coming out in flexible packaging. And even in the medical device in the medical industry, predominantly that packaging is remaining in flexible. But a lot of your kits and medical devices now are coming out in more advanced flexible packaging. But we did talk to companies and say, what is their outlook for the future? And 61%, two out of three companies that were interviewed said they'd reached their level of flexible packaging and they don't anticipate any further changes in the near future. Which is a shift from five years ago, when only 49% said they had reached their level of flexible packaging. So over that course of five years, there's certainly a good portion of companies that continue to move products into flexible packaging were appropriate and have now reached a saturation level. But we've still got one out of three companies who are continuing to increase and evaluate flexible packaging. And just a very small percentage went to flexible packaging, returned to rigid, some very specific consumer requests and brand identity. This chart gives you a good idea of types of products of the companies that we spoke to. So it was everywhere from bakery snacks and all the way down through marinades and sauces and nuts and soups and coffee and chemicals and household products and personal care products, injectables and some generic and RX drugs. What this does is gives you an idea of we asked companies, are they going to be using more flexible packaging, packaging mixed staying the same or packaging returned to rigid? And in some instances, some of the product categories represent all three. For instance, candy. We talked to several candy companies. Some of them were using more flexible packaging. Some of them were staying the same. And in one instance actually was returning to rigid. So it certainly depends on if you're looking at specific customers to see where they're at in their manufacturing process of rigid versus flexible. Donna, can I interrupt for one second? Sure. We have a question about slide 14. And I thought maybe we could go back to that before we go any further. Okay. Let me get that down. Let's see, I'll wait until you get to it. The question is reduction in packaging size and shapes. What does that mean exactly? Well, it's really being driven by the consumer. Smaller portions, smaller packaging. We see a lot of the 100 calorie count now that is coming out in many different types of products. Portion control and just the reduction of packaging in terms of serving the on-the-go, eat-in-your-car type society that's really been growing over the last years in terms of reducing the size of packaging shapes. And it's being driven by the consumer. So more like on-the-go eating is a part of what's driving that. Absolutely. More convenience on-the-go eating in the car. There's several studies that PMMI has undertaken that particularly in the bakery and the snack food industry addresses that really well in terms of the on-the-go lifestyles that are changing. Great. Thank you. Okay. Let me jump back. So we were just going to talk about here about the types of flexible packaging that are used most often. And while pillow pouches certainly the most dominant in being used now, stand-up pouches is really right behind that. And stand-up pouches moving towards is at a greater rate. So companies particularly are looking at the stand-up pouch. It provides great shelf appeal. It allows the, you know, a 380 degree billboard. So the printing capability, the color graphics, there's a lot that can be done. And certainly the resealable of stand-up pouches is very attractive. We heard lots of different scenarios of how companies were moving in this way. You know, some cans were moving to pouches and we've seen it come out in soups. We've seen stand-up pouches come out in different types of convenience goods. Again, it's that kind of grab-and-go candy particularly is really starting to come out more in stand-up pouches. But certainly, you know, there's a lot of multi-layer that's going on in the stand-up pouch for protection and retortability. So we'll get into some of that when we get into the material area. So what are the some of the advantages and disadvantages when using flexible materials? Certainly some of the advantages are lower cost per package. But then, like I had said, we'd heard some indications where that necessarily wasn't the case for every manufacturer. But for overall, manufacturers are seeing a lower cost per package. An improved shelf presence is one of the high advantages that flexible packaging brings, like I said, better barrier properties as well and differentiating products on the shelf to appeal to consumers as they're walking by. It's certainly lower shipping costs in terms of the light-weightedness. And some of the disadvantages that we've heard about were some of the sealing issues out there in terms of the closability once it's opened and re-sealed. Some companies are still dealing with that. And the machinability of the variety of film gauges and strengths and different types of layered film still causing some machinability problems out there. But some of the reasons, one of the questions we asked is what are the top reasons that would encourage you to change to flexible packaging both from a packaging performance and manufacturing performance? Again, cost savings per package comes up as the first thing regarding packaging performance, material reduction, again, improved barriers. So there's certainly consistency and even redundancy in what we hear from the manufacturers, which gives a high confidence in terms of what flexible packaging is bringing to them. Certainly a reduction in labor, higher output again, lower transportation costs and lower operating costs. Let's look at some of the trends that are really influencing why flexible packaging is gaining popularity. Sustainability initiatives, we talked about this at length and actually went back and had some additional conversations in this area. Flexible packaging, in terms of being a highly sustainable material, it's not so easy with flexible. It's primarily, again, about the cost of choosing flexible packaging. But sustainability certainly remains top of mind, trying to use renewable materials, reducing material usages wherever possible, recycling wherever possible, and again, minimizing the overall carbon footprint, which remains top of mind in all aspects for manufacturers. So when the packaging is taken out of use, it becomes waste. We put these definitions in here so that you can go back to this and review this more carefully. I've always packed these webinars full of quotes and comments that help you understand the why behind some of this when this becomes a standalone, something that you can look at and share with people at your company. But recovery, recycling, composting, and biodegradable. That's really the four words that make up what happens to our waste at the end of its life cycle. We'll get into a little bit more detail here because flexible packaging, while it's rising in popularity as a primary package, it needs greater strength and the secondary carton to protect that flexible packaging and the product that it's carrying. So lightweighting primarily requires better support from the secondary packages. The primary package changes. And we talked about Europe uses less packaging with stricter disposal regulations compared to the US. They have a disposal, which is the ERP. We don't have anything like that for packaging here in the US. They have three ways, and they have all 27 EU countries adhere to this, three ways to recover their package. It's either mechanically recycling it, taking it and recovering it and turning it into fuel or organic recovery and composting that, which flexible packaging doesn't lend itself very well at this point to composting. Earlier trials were done and it didn't prove successful. So one of the things we talked about with the manufacturers and some of the experts in the industry is ERP, how likely is that to impact the US in the near future? And the president of flexible packaging association talks about it's ERP will not impact us for a long time, but it's already indirectly affecting the US and that one in three manufacturers maintains global uniformity for their flexible packaging designs. But ERP is not being discussed by many of the customers out there in terms of the manufacturers or even the retailers. So it's not something that's top of mind here in the US, but it is certainly something to be aware of in the future. And we talked about some of the packaging regulations in terms of how they're impacting. We heard one company talk about the manufacturing moving it overseas because of some California legislation, which has been at the forefront of most of our legislation in terms of packaging. There are restrictions on which kind of chemicals can go into flexible packaging. There's specific regulations and certain hazardous substances that don't lend themselves well to that industry. Labeling regulations, certainly the whole nutrition labeling regulations is something that flexible packaging makes it a little bit easier having more space on the package itself. Again, back to some of the additional regulations that the EPR, which is the extended producer responsibility and the green dot program in Europe, definitely is a regulation that is in place. And what it does is it puts the responsibility on the producer, the brand owner to pay a fee per package according to many different scenarios of that package. And they pay a fee for that and in many instances that fee can be lessened by a flexible packaging, which is lighter weight. And that gets into a little bit more detail here on this slide. I've already reviewed it quite thoroughly, but we did speak at length with two of the people that did a global pouch forum, an end of life management outlook in June of this year. And it was good news for the flexible packaging, the life cycle analysis that they presented because it performed well in respect to material's use in the overall carbon footprint and waste reduction. It lowered the ERP fees, just as I had mentioned globally, and it has higher consumer acceptance. But some of the negatives that they found in the life cycle analysis using pouches was being able to dispose of it, the litter that where our waste and our packaging waste ends up. But the challenges for greener advancements in the U.S., certainly there's state and local government budgets that look at recycling, although our program here in the U.S. is not anything near like what it is in Europe. So something to be aware of, like I mentioned, we did canvas people and interviewed people of how soon do they think that might impact us, and it's not something that's going to be going through our legislation in any time in the near future. So if we look at what's, what are some of the external influences versus some of the direct influences consumers, we buy convenience, and marketing is responding with that innovation. And that innovation in a lot of instances is a more flexible carry-around type package. Big box stores continue to influence the use of flexible packaging and how they want their store shelves to be displayed. And like I said earlier, some of the larger restaurant chains are now looking at flexible packaging to help them with their food service and convenience that that brings. But really the consumer, we are the driving influence of packaging styles. Individual servings answers the question that we had a little bit earlier of package sizes and shapes and what does that mean? Easy convenience, grab-and-go functionality. We want it to open and close quickly. We want multi-packs. We want variety packs in and all of that as a consumer. We're always looking for the cost-effective choices. Marketing is driving a lot of the choice of flexible packaging in terms of design and in the shelf appeal and consumer appeal. Sales certainly has an interest in that R&D and obviously working with the package designer as well. So how is this all influencing the machine builders? And where are they looking for innovative designs? Innovation in itself just defining the word innovation means different things to different people. But we've talked to people that we interviewed and how do they view innovation and where do they see it coming from? And the majority, three out of four companies, they expect innovation from their materials and machine builders. They depend on it. They ask for it. They look for it. And very small percentage said they didn't feel that they were getting it. So in terms of meeting the needs of the end user with innovation, material suppliers and machine builders are answering their needs. But there still remains machine challenges with thinner gauge films. We talked to both the end users and material suppliers. It was surprising that the material suppliers actually more frequently acknowledged that there were challenges with thinner films. They're aware of a problem. They're working to solve that problem. But certainly the combination of using thinner films and wider sizes and faster speeds is never a good combination in terms of making it easy for manufacturing. But they certainly are not turning a blind eye to this. All the material suppliers we talked with said it's something that they continue to work on. Sealing integrity at higher speeds is something we heard was a problem. Sealing in general was one of the top reasons of the challenges that we heard. Inconsistent film quality, like I said, the material suppliers are certainly aware of this and working with end users and machine builders to bring some resolution to that. There is often times slower filling speeds using a flexible package that's definitely product dependent. And certainly just the transition between packaging styles if a company is moving from rigid to flexible packaging, they have manufacturing challenges they're going to have to come in contact with as well. In some other very specific challenges here, we listed them all as you go through this with your teams and your companies. There might be something more that you relate to directly in terms of some of the challenges you might be experiencing as well. But we looked at in terms of how end users are considering their current equipment. Do they look at their current equipment first during package design or do they just design the package and then acquire the equipment that they need? It's a combination. Nearly half of the manufacturers that we talk to, they really consider both options. Certainly try to avoid buying new equipment if they need to or if they don't need to. 55% of the top we talked to you said that they consider their current manufacturing capabilities during the package design. So they're looking at what capabilities do they have and how can they most efficiently bring out innovative new designs and certainly if their product lends itself, how do they move into flexible packaging? But then there's certainly a handful of companies that are going to move to flexible packaging that are going to acquire the equipment that they need to accommodate that package. So then we've looked at what are the reasons, what operational reasons are driving change and production output increasing. We've heard this for several years now. Oh, since projects that we were doing in 2008, even some PMMI reports as well as some proprietary reports that production output increasing, we continue to hear it in our conversations. Increasing product changeover, there's more SKUs now in a manufacturing location than before. And changeover needs to be as quick as possible, looking for flexible machinery that can handle a variety of packaging sizes and be able to have that changeover to be as quick as possible. Again, like I just said, easier changeover, we ask them, what is the number one machine improvement you'd like to see in flexible packaging? And this is not just flexible packaging, we hear consistently easier and faster changeover to handle a variety of packaging sizes and a variety of film types. So that does remain number one top of mind at end user manufacturers. Again, improved seal integrity came back up in this part of our conversation. And just easier to use simpler machines for operators to use, cleanability comes up as well, being able to easier and faster have a machine cleaned and back up and running. Then we asked the people that we interviewed, where do they source their machines typically? The majority of machines in the U.S. are U.S. sourced. And this is only from the participants of this report. This is not a broad statement, but on average global sourcing of packaging equipment, the majority of it is coming from the United States, second Europe. So 78% of the end users that we talk to approximately three out of four facilities operate more than 50% of their equipment as U.S. sourced. Parts availability, local technical support, pricing, getting the equipment when they need it. So certainly that remains consistent. There's a secondary report that we've done that also shows that this is very consistent. But all of the participants, nearly all of the participants except one company, has experience purchasing and operating equipment that's non-North American based. So it certainly is a global community in terms of packaging and machinery and acquiring that machinery where needed. So if we look at flexible packaging, manufacturing occurs, where is that occurring? It's certainly closest to the site of sale. So the majority of companies that we interviewed operate their operations for the most part in the U.S. or wherever that's going to be closest to the site of sale. So if they're manufacturing overseas, they're manufacturing where that product is most likely going to be consumed. And we asked about what about in the future? How do they see that changing? And pretty much it's staying the same. We did hear a few companies who were increasing their manufacturing overseas and actually a medical device company that was coming back to the U.S. There's lots of reports on reshoring. It's something we continue to hear about, not particularly in this industry, but some of the other industries are reshoring back to the U.S., again, very specific to product and manufacture. So if we look at contract packaging, what role does contract package players play in this industry? They have a significant role. Two out of three companies are using co-packers today. The majority of brand owners that are using contract packages, though, it's at a small percentage. Five percent or less of their packaging requirements are being handled by co-packers. And the reason, certainly, that they're using them as convenience and a test market product or getting a product to market quicker if they don't have the equipment, a co-packer can do that for them, they're certainly then moving in that direction. And using co-packers in the future, not seeing it changing significantly for the most part, staying the same. Their role is significant and important. There are several companies out there who predict they will begin using co-packers at an increasing rate in the future. And why are they using co-packers again? As I just reiterated at the avoid capital expenses, if they're looking at testing a new market or a new product, if that co-packer certainly has the expertise that is not in-house at the manufacturer, minimizes risk with any new product trials just in terms of is it going to be successful in the future, they'll try that out with a co-packer first. And certainly smaller packaging seasonal runs are typically with a co-packer as well. So some of the material innovation that we're looking at, not significantly anything new here that we found out, but 63% of the companies, two out of three, continue to look, consider, test new materials, looking for better barrier properties again, that was one of the top goals that they're coming up with. Extending shelf life, looking for puncture resistance, improved ceiling again makes that list, light weighting, improved clarity, some of the properties that we've already certainly talked about. There wasn't anything significantly new that we heard in this area. Some of the plant-based products that we've heard about in the past have not necessarily panned out. They can be very costly and as the cost of oil has gone down recently, then some of that exploration in other areas diminishes and the availability lessens and it increases the price. So there's been some concerns on strength of those materials and the availability and using them in general and like I said in many instances is actually costing more. We talked about the impact of nanotechnology in the packaging industry here for flexible packaging. The majority of the interviews that we did, they weren't really aware of the impact that nanotechnology can have. It's really the science of small materials and small molecules, but it certainly can offer in some instances stronger barrier properties. It can have some antimicrobial agents which would be enhancing sanitation on that package and a host of sensors that can detect and trace contaminants and gases. There's lots of different things. Again, it's a costly initiative, not really widespread at this point, but nanotechnology is changing our lives in many ways and we'll see it enter this market more significantly in the future as well. When we talked about what are manufacturers looking for in the characteristics to extend shelf life, certainly multi-layer and freshness were top of the list. It's again the barrier properties that flexible packaging offers. And then if we looked at sourcing the materials, this very much is consistent with sourcing the actual machinery, but most of the materials that are being used in flexible packaging in the U.S. are being sourced in the U.S. In terms of finding the best material, 90% of on average manufacturers source material from North America if they're manufacturing here in North America as well. Better lead times, gauge of material is more consistent, service, pricing, all the reasons involved in sourcing materials here in the U.S. So if we look out at the future, how are flexible packaging, what role will continue to play, and what are end users looking for? In terms of services, over half of them are looking for training, understanding the machine capabilities, aftermarket support. There's a very detailed aftermarket parts and services report that PMMI put out earlier this year that gets into these details much more significantly, but training and aftermarket support is certainly a differentiator and something that the end users consider significantly. And they're also looking for improvements in technology in terms of automation and easier to use and finding ways that machines can do shorter runs and still be cost effective. We continuously hear this even beyond this industry in terms of flexible packaging, it's industry-wide. Certainly the sanitary design, more and more conversations we've been involved in several others about the mechanics and the safety of the actual design of the machine, using more stainless, easier to clean, easier accessibility to cleaning in all aspects of that machine. And certainly end users are looking for collaboration between themselves and the suppliers and the machine builders, looking at best practices where having everyone together at the same table is certainly an advantage for all parties. So what are some of the greatest obstacles we end our conversation with a couple outlook questions of the future? What challenges do they have in the future? And they both relate to material challenges, which we've covered in several slides here, the material inconsistency and certainly finding the appropriate materials that they need. And also improving operational challenges, reaching those higher production efficiencies and doing it in a manner that is most efficient. And again, flexible equipment to accommodate different sizes and different products. We hear that consistently across many different markets. And if we look at what we're looking for in terms of predictions and flexible packaging, definitely advances in flexible packaging use and innovations in machine design. It's the outlook that end users have in terms of when they look out at the future, what do they see? They see greater use of flexible packaging. They see improvements in properties and film consistency, lower cost materials. And certainly some of the regulations that are affecting Europe will likely be imposed in the U.S. but most, like I said, experts say not in the near future. But if you look at the flexible packaging machine of the future, it's certainly going to have innovation. It's going to be able to handle different size products more efficiently. It'll have faster changeover to handle smaller runs that's increasingly becoming more popular. Design improvements to have better sealability more reliability in that seal, certainly increasing speeds where appropriate and in general, more automation in packaging equipment in general to improve uptime. And certainly a continued competition from overseas. That brings us to the conclusion this morning. Or for many of you on the East Coast this afternoon, I would encourage you to download the full report of flexible packaging at the PMMI website as well as downloading the new 2016 flexible packaging playbook that is really intended for the manufacturer who has got a new packaging project coming up in flexible and a lot of recommendations on how to make that most productive and efficient. So I will turn this back to you, Paula, if there are any questions you've got posted. That sounds great, Donna. Thank you for all the insight and information on the trends and issues within the flexible packaging industry. As I mentioned earlier, we can open up the session for questions. So if you have any questions, you can enter them in the chat box on the right hand side of your screen. I do want to say back on slide 21 and 23. Let me see if I can get there pretty quickly. There were some mentions about some interviewees speaking to total cost of ownership and PMMI's OPEX Leadership Network addressed this earlier with a playbook this year. And I just sent out a message, if you look at the bottom of my hand corner of your screen, their website is opx, opxleadershipnetwork.org. You can go to total cost of ownership playbook and download that which should also give you some more insight on any of those questions that you might have. Right at the moment, we don't have any questions. Donna, it was a great report that we did. Great information in the webinar. I will piggyback on what Donna said. Please go and download the report. There is a wealth of information on it, PMMI.org research. On behalf of PMMI, I want to thank you for participating in today's webinar. And as a final note, you will be receiving an email to complete an evaluation for today's webinar. It'll just take a couple minutes of your time. Let us know how we're doing. Let us know how we can do better and let us know what reports you might like us to do some research on. So again, I thank everyone very much for their time. I do have one question here. Mentioned many times the findings are industry wide versus only flexible packaging. Deb mentioned that. And I'm not quite sure what she pertains to. Deb, you can hit star two to unmute your phone or you can email me directly and I can answer that question in further depth to you. I can answer it a little bit further. Some of the equipment desires when I say they're industry wide, it doesn't relate to just flexible packaging. We do a lot of research in a lot of different industries. We consistently hear the increasing production is driving a lot of change at manufacturing locations. And they're looking for equipment that can easily change over and handle the variety of sizes that they're being faced with in shorter runs. So having equipment that is flexible, handle different sizes in different shapes is not unique to the flexible packaging market. That's what I referred to you often times when I was saying it's industry wide. Some of the desired attributes that manufacturers are looking for. That's great, Donna. Thanks for the clarification on that, Deb. I hope that answered your question. And once again, thank you for participating in today's webinar. We will have another one coming up towards the end of January on food packaging trends and advances. And so I hope to talk to everyone then and have a great holiday. Thanks again, Donna. Thank you, Paula. Thank you, everyone.


I am Dr. Chhaya Patil, senior consultant obstetrics and gynecology practicing at Malthi Manipal Hospital, Jainagar, Bangalore. I have been associated with this esteemed setup since a long period, almost 8 years. And as you all know, there is general awareness in the public and it is an experience of the public as well that Manipal is known for state of the art technology, its ethics and it's one of the pioneers corporate hospital in Bangalore which has earned its name and fame and people all over the country and particularly the South India, they rushed to this for high tech services at a very nominal price. So it's my prestige and honour to be associated with such a good setup and it's not only the quality of work, it's a passion, it's a commitment and the quality of services given to the patients. So here we have a beautiful team of obstetrics gynecologists backed up by our efficient pediatric friends and other medical and surgical backups.  And I practice routine and high risk obstetrics gynecology as well as laparoscopy endoscopic surgeries in gynecology and we deal day in and day out with all kinds of obstetrics patients, low risk, high risk and all kinds of gynecology patients with different problems. So recently we had a couple of very high risk obstetrics patients where we have delivered successfully thanks to our pediatric friends and the babies have gone home in a sound state of health. The take home baby rates are very high backed up with efficient care. The surgery, the confidence to do the surgeries in difficult cases is boosted by our excellent, caring and competent anesthetist team and our ICU care. So I'm happy to say that our administrative team is fully supportive, arranging everything in times of need, be it blood, be it emergency services, be it other facility, anything which safeguards the health of the patient and what is in need of the time. I'm really fortunate to work with this setup and we hope with everybody's cooperation we earn to achieve higher results and we are committed for patient safety, care, dedication.


Nearly 2,500 local high school students were scoping out possible future careers today. Our Sarah Winkelman takes us to the Bridges Exploration Day held at Central Lakes College. It's really fun having a lot of options that you can choose from and they're just right there you can go for. The CLC campus in Brainerd was buzzing with eager students looking to the future. Students are out exploring careers and we have over 200 careers that the students can come out. They can do some exploration, they can do some hands-on activity. There were about 100 local businesses at the event organized into clusters, one of those being public safety with a stop from the Brainerd fire department. The students try on our gear, actually do kind of a mock room search to kind of get a feel of what it's like to put on this fire gear and be a firefighter. Many students were up for the challenge and completed the mock room search all while not being able to see. It was really heavy and hard and sweaty. Other businesses just spent time talking with the students. Sometimes you get split up in your head and you're like I don't know what careers there are so it's really helpful just to come down here and see all of the possibilities. With a focus on networking amongst the students. What our hopes and dreams are is that youth will come in and they will be with their friends like a large group or maybe their best friend with them and they're experiencing it together. With all businesses located within a 60 mile radius of campus. So that we don't have that brain drain going out of our community, we can keep gifted and talented students right here in the Brainerd Lakes area. Reporting in Brainerd, Sarah Winkelman, Lakeland News. A total of 22 schools participated bringing freshmen from seniors to the career day. If you enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland PBS.


The Prophet sallallahu alayhi wa alayhi wa sallam, he said in a hadith, Man sallah rak'atani lam yuhaddith nefsahu fihimah bi shay'in min ad-dunya ghufira lahuma taqaddam min dambih. Whoever prays two rak'ahs and their nefs does not, you know, you are not, you are not listening or giving the opportunity to your nefs to speak to you about things of the world, the reward for having that level of presence in nasada is that Allah forgives your previous sins. So once again Imam al-Ghazali is saying this is critical for the prayer to be accepted, to be of those people that Allah subhanahu wa ta'ala when they establish a true prayer they're transformed and they avoid al-Fahshat wa al-munkar in decency and wrongdoing by being present in the Salat, by not giving into the insinuations and the internal conversations of the nefs that take us into the dunya.


This is Chico. Welcome to my channel and welcome to my patio. Now what we're gonna do today, this morning, is harvest some grape leaves that we're gonna wash and put in the freezer and when we're ready, we're gonna use to make some dolmas, grape leaves dolmas. Now, this is something that I haven't done in the past. I've seen my grandmother and my mother and the rest of the elders in the family do it for a number of decades, but I've never actually harvested the grape leaves myself and I called up my mom and I asked her what I'm supposed to do and I knew basically, but I wanted to know if there's any little tricks that they had that I had to keep in mind that I hadn't noticed, right? But basically, she told me just to cut the grape leaves and I got a bowl of water here, so I'm just gonna put them in this, okay, and after we get a few, what I'm gonna do is add a little bit of salt onto the water and just give them a wash and when they're wet, I'm gonna dry them a little bit and then I'm gonna you can either do it two ways. You can roll them up. That's what my grandma does. I'm not sure why she rolls it up, but she rolls it up and puts them in the freezer, right? But my mom basically told me I can harvest them and just wash them. Okay, let them dry a little bit or let them dry and then just put them flat on top of each other and put it in the freezer and then when I'm ready to make the dolmas, what I'm gonna do is basically take the grape leaves out and put them in hot water and what that does, it loosens up the grape leaves and then you can take the grape leaves one at a time and make your dolmas and that's probably something what we're gonna do during a cooking stream. Okay, aside from that, I'm gonna go and get our grape leaves and I got a my trusted kitchen scissors here. Okay, so I'm gonna bring them over and just put them in here. I'm not sure how much we're gonna harvest. We're gonna see but what you want to do is harvest the grape leaves in the spring because in the spring the grape leaves are fresh. They're coming out and we're in end of May right now. So I'm getting we're getting close into summer but I was waiting until the grape leaves were big enough, right? So you don't want to grab them, grab the grape leaves towards the end of summer or mid-summer. You want to grab them towards, you know mid-spring, late-spring, early-spring if they're coming out early because they're thinner, right? So you want the grape leaves to be thin. You don't want them to be too thick because it just becomes heavier dolma unless you want heavy dolma, right? But thinner dolma is what the grape leaves is, is really nice thick enough that it doesn't break down when you cook them, okay? So we're gonna harvest some grape leaves. Let's see how long this thing takes us. Cut them right at the stem thing, right?  We got lots of birds singing and stuff. It's really nice outside. Fantastic grape leaves. Look at this. Awesome. So we got five so far at this rate, it was not gonna take us long at all and these grape leaves are from or the grapes they're from. Take a look at this. Sometimes you get these little bugs on the grapes and there's some that do and I go through and I try to find the leaves that have these little bugs and they burl in there, right? So you see them when you know, there's the grape leaves are puncturing out. You see these little deformities in the grape leaves. So you don't want these ones. So I'm gonna throw this one over the balcony or just become compost slowly, right? But basically these are the ones that you don't want. They got little deformities and even there's little bugs in there, right? Unless you want a little extra protein. Nice leaves. Little bit of yellow in here, but that's okay. Beautiful leaves, beautiful grape leaves. We're gonna make ourselves some duelma later, probably in the summer. And this is a grape vines that are coming over from our neighbor. The main grapes are from the neighbor that I came over, the fencing that they have. And I built that contraption there, this sort of wall about when we came here, when we noticed the grape leaves, I was like, oh wow, there's grape leaves coming. I'm gonna start directing. I'm coming up the patio. And I built that wall about three years ago and it took two years approximately for it to reach up to here. And last year we had it canopy over us, right? So we got shade when we're sitting down here and this year is just growing. I might start directing some of the leaves to come in this direction as well. Right? So we get a nice little canopy and we're gonna have an area where we get lots of sun, right? Fantastic. Look, they're giving off little shoots at the end of these two. Some of them have it. This one's okay too. We use this. That's beautiful. It's amazing having your own plants and stuff that you can harvest. It's in your backyards, right? Let me submerge these. And then what I'm gonna do, I'm just gonna fill up the bowl with water and put salt in it and just give them a nice wash. Okay, let's grab these where they're all bunched up together, right? My grandma would love this. Wow, wow, wow. If I get the opportunity, I'll bring her here for the summer to be facing the same way, right? Lots of tulmah, lots of tulmah. The bug's eating a little bit, so we're not gonna use this one. We just throw it for the compost. Look at this one. This one's beautiful. These ones too. Look at this. Nice and round. Look at this one. What a beautiful leaf. Where is it going? Probably two, two batches of tulmah, which is good for a first try. Fantastic morning.


Well, I suppose Mr. Wildworth smells pretty nice, you know. After all, he's living up there with bankers and cologne and all that nice smell, the sweet smell of success. I wish we could all smell that way. Further in this same article, it says that your operation is based on theories about community structures that just don't stand up to examination. His analysis or statements about our theories of organization demonstrate an extraordinary degree of political illiteracy on his part. One of the other themes of this article that you have read is that you ignore the fact that there has developed ways of dealing with things that depend on cooperation. Sure, there's cooperation, but you cooperate after you know you'd better cooperate when he talks about his professionals and his ways and means. What do you think these major religious institutions in Kansas City are, or in other parts of the country? Dottos? They don't know these new ways. He just doesn't know what he's talking about. And for a guy who says everybody relax, you got nothing to worry about, everything is going to be alright and so forth, nothing's going to happen. He sure is talking an awful lot and awful scared, isn't he?


All right, welcome everyone. Thanks for joining in. It's a real pleasure to have Harni here from Thoughtbooks. She's gonna be sharing her experience with building security practices into CI CD pipeline. As you know, especially since the COVID time, security has become extremely crucial and the companies trying to see how they can shift left and build security practices early to get that feedback. And so it's awesome to have Harni with us to share her experience. Yeah, Harni, over to you. Thank you, Nareesh. I'll just share my screen now. Hi, everyone. I will be talking about how can you build security into your continuous delivery pipelines. And a little bit about me is that I have been a quality analyst and I've been with Thoughtbooks for more than 11 years now. The last three of which I was playing the security practice lead and currently I am the capability lead in there. I'm also a core contributor and product owner to a security tool called Talisman. It's open source and I love training for quality related topics, for security related topics or anything that I have any experience in. And I'm definitely a non-source evangelist. So if you want to talk about some of the open source work that goes on or things even in the security space that can be brought in, I'm your person. I'll be happy to talk about it. So that's about me quickly. I have a lot of slides. So I'll just start with the relevance of this topic itself. And why do we need to talk about it? So there is one thing that has been in the industry which is about thinking about quality later. And then we became agile and we thought that that was very waterfall-ish and we need to move everything left. But when it came to security, it's still in the hands of very skilled niche team which sits out there and we really haven't done very much in the industry to be able to figure out how do we move towards the left more, right? So just a quick question to people and people can probably hit their thumbs up button on their screens. How many projects actually have some form of, let's say penetration testing or production security controls or there are some level that is put in around security controls on the networks. How many of you have that? Can you do a thumbs up on your screens? Few of you, all right? So while we have that, which is great because you still need it, right? In no way my talk says that these are not needed, right? But if that is all you have, the same cost of defect argument that I'm sure all of you are proficiently well aware of, the cost time risk of finding a defect that late is much higher. It's still reactive, right? And the question is how do we become more proactive? And there are many things that you can do to shift left. One is about continuous testing. You could be building a security architecture. You could be putting in proactive controls. And that is something which will give you more continuous feedback, more early detection, right? So the point of this talk is that while there's value in what we have in the left, we still need to shift left, right? And within that, there are again so many things that can be done. So for today, and security is a very vast topic. So for today, what we will be talking about is what can we do around the continuous testing place? And within that, what do we do in our pipeline specifically? Now, when you talk of application security itself, right? There are again many types of security that could be there. But if I concentrate specifically on application security, this is a model that helps me think better. So the four Cs of app set is code, container, cluster, and cloud. And for the limitation of time in this topic, I will be talking mostly about code and a little bit of container security, right? And what can you do in the pipeline? So I'll not be touching upon cluster and cloud. But even within that, there are so many tools, right? There's so many of them. And you go out and you check anyone's website, everybody will tell you that they are the best, right? Which is fair. I mean, of course, while they're releasing a product, they would be looking at many things from their side. But as a practitioner, what does it mean, right? So I have some experience in using these products and more, this would be like about 100 of the products which are out there. If not lesser. I have some experience in using these. I have some experience in consulting with companies on what to use and how to use them. So I will try to make use of this 40, 45 minutes that I have with you to give you some brief of how do you select what you need? What products do you need? What categories of tests do you need, right? So for building secure pipelines, I'm going to give you a practitioner's approach to building secure pipelines. I'm going to be telling you about my experiences and it is going to be opinionated, right? Cool. So a simple pipeline, very simplified, of course. I mean, on your project, you would probably have much more crazy pipelines than this, but let's just simplify that, right? So let's say you have built, you have your code level tests, you are packaging, deploying to a lower environment, test environment, dev environment, whatever it is. You have some functional tests that you have and then you deploy to a higher environment, correct? So let's say this is your simple pipeline. Now, if I have to inject security. So before injecting security, one of the things to understand is why are you injecting that security? What are you trying to achieve, right? And based on that, there would be different categories, okay? So first, how many of you, again a thumbs up if you can please, how many of you have pen testers or a security team which comes towards, you know, after you've performed all of this and comes somewhere closer to a release and performs some testing on your code? Thumbs up please. Okay, a few, a few there too, all right. So what is it that they do? Yeah, so they would usually have some dynamic analysis tools, right? And they would be testing on multiple layers, of course. And as I said, I'll not be getting into cloud and cluster and all of that. But as far as your code goes, they have something called dynamic analysis tools. And they would be trying out different scenarios against your application, right? So it's a black box for them. And they would try out different scenarios at that point. Yes? So what you can actually have to replace some of their work is called a DAST or a dynamic analysis security tool, right? And we'll talk about this in a bit. And the idea of putting these tools is not because you want to get rid of the pen testing team or the security testing team. It's like saying that you don't need, do you not need exploratory testing if you've got automated tests in there, right? So you're freeing up regressive work which they would have otherwise done so that their niche skills are actually utilized to do more exploratory testing and finding out what other issues could be there beyond the ones that they have been regressively testing all the time, right? So talking about DAST tools, right? This is your first category of tools. So how does a DAST tool work? So it's a black box testing, right? So between your browser and your application, there would be communications, right? A DAST tool essentially uses the concept of intercept proxy. So it sits between these and they will be able to listen and that's why you'll be able to also change requests and you can, what we call fuzzing, right? So you could fuzz the requests which are there. So basically deals are the request response layer, okay? So the qualities of this, it is for black box functional integrated systems, right? It is at that level. You can find common vulnerabilities at app level using this and it can be used for either manual or automated analysis. So even our security testing teams use this for manual analysis also because they have to understand what your application is about and you can use it to automate as well but we'll get to that. What can you automate and what does it mean? All right. Oh yeah, and it can of course detect runtime flaws. So what would you do? There are tools again and these are only two or three tools that are putting in a bunch of them there. But what can you do to analyze how do you choose which tool you need to take in, right? One of the things that you have to remember is that DAST can actually perform both passive scans and active scans. What do I mean by that? Is that when you're intercepting the proxy doesn't mean that you have to change a payload, right? You could be just listening in and you could just read through that and understand that it's missing some headers or some of the payloads look suspicious or that there are open API tokens which are going through. So you could have some checks or some tests on that, correct? So that is a passive scan. You're not interrupting with anything that the application does. An active scan is where you're actually injecting malicious stuff. So I'm seeing how the application would respond to that. So you'll be injecting payloads for let's say injections. So there are concepts of SQL injections or XSS and things like that. You'll be trying to inject that and see if the application is built to be resilient to all of that, right? So you could do both of these things. You could do passive scanning and active scanning with the tools that you can pick up. One of the common things that you're going to hear across all of these security tools that you're going to be talking about that they could be false positives. Why is that? Is because all of these tools are actually built by the community to help you and support you folks to say that, you know what? These are some regressive things. These are some common tests which would be there. Here's our brains from being a security researcher into the tools as tests. Go ahead and run them. But when it comes to your project context, it may or may not be true anymore, right? So you will have to deal with false positives across different security tools. So one of the things that you should always look for is how easy it is to suppress or teach the tool that something is false positive for you and you don't want it to keep interfering with your pipelines, right? So this is something which is very important and it'll go across all kinds of all categories of tools which are there. Configurability is one of the things that you should be looking at, specifically of the test or within the test itself again to make it more relevant. So if you have a no SQL backend, why would you want to run SQL injections, right? So those kinds of configurability is very, very important and you should be able to run thresholds. We talked about test data modifications, fuzzing, crawling, crawling is basically looking at an endpoint and going across and seeing what all other endpoints it is able to reach out to. This is something which actually sets different tools apart from each other, right? And when you look at reporting, this is a black box, right? So usually managers or higher level officials might want to take a final look at what are you getting at the end. So this is a reporting where it makes sense to actually have dashboards or drill down mechanisms so that there are different people who can look at this. Talking about the tools, Burbsuit, this is OWASP's ZAP, Z-Attack Proxy and Acunitix and there are many, many more. So ZAP is completely open source, right? It's completely free and open source for anyone to integrate and they're doing some really cool stuff. Burbsuit is usually a favorite with penetration testers and but if commercial is one of the things that you're looking at, Burbsuit, the free version helps you do the manual scans but if you're trying to automate you have to go for the pro version, right? So think about that when you're thinking about commercials as well, right? Acunitix is also paid and there are a couple of others as well. My personal favorite, as I said, it's an opinionated talk that I have. My personal favorite is OWASP because it does almost everything that any other tool would be doing and it's open source so I don't have to fight for commercials. It's just that you need a little bit of learning curve to get to it. So you have to get, like Burbsuit is amazing when it comes with the GUI and the learning curve is really easy but ZAP actually needs a little bit of learning curve to go forward. So in my pipeline, I'll just quickly show what a ZAP report looks like. I did a passive scan on one of my pipelines and this is what the ZAP scanning report actually looks like. It will tell you what the summary is and within each it will tell you what happened, what did it find, right? So I didn't have any high issues on my repo. It tells you what did it find. It tells you where you would find it. So it goes down to exactly the URL method that it did that and it gives you a possible solution as well, right? So it tells you that you could be fixing this if you did with this solution but again, you have to take your call for your own project itself, right? So there's a quick look into what the report would look like. Now, the fun part is practitioner steps. So things where you actually get down to doing stuff and this is what you're going to be facing. So integration with CI is first and foremost. So when you're looking at any of these tools, see how easy it is to not set up necessarily on your machine but how easy it would be to set up in an agent, right? And specifically when you're using dynamic agents, how are you going to deal with that, right? So think about integration with CI because not every DAST tool gives you integrations. Analyze the manual test first. So your penetration testers are finding issues, are finding things that can be put into DAST. So think about that and then add them to automation and look at writing your own functional tests for better coverage, right? Don't rely on only DAST tools to do the functional testing for you. Cool, the next thing is that you have secure code reviews which come in, right? There would be a security level proactive controls or not that some of you folks could be looking at or they could be a security engineer who actually does that as well for you. Anyone who has that thumbs up in their projects, okay? So when you have security reviews, what are they looking at? Let's look at that, right? So they would be either looking at static analysis and saying that if I look at the code itself, what would it mean? What would I be testing for? What are the common vulnerabilities in the lines of code that you have itself, right? The other thing that they would be looking at is the data. So are you leaking any sensitive data which is there? And the third thing that they would be looking at is, are you inheriting anything from the libraries which are vulnerable in itself, right? So those three categories are SAS for static analysis or code reviews, secret scanning, which is to understand if you're leaking out any secrets or any sensitive data and dependency check, right? Which is to say that the dependencies that I have, so the components that I depend on, the libraries or the packages that I'm using, are there any vulnerabilities within them itself, yeah? And why do they lie in here in the cycle or in the pipeline? Why do I suggest that is because, well, secret scanning can run on raw code, okay? It doesn't need a compiled or a built code. It can run on a normal raw code and can do some pattern matching over there. Dependency check, however, needs a built code. So if you don't put it after build, it will do its own build and then it'll figure out what are the packages and things like that and so it'll work on that. SAS can run on both. It can run on built scanning or it can be, sorry, on a built compiled code or it can be doing that on raw code, but that differs for every SAS tool that you pick. And so it could be doing a binary analysis or a source code analysis. It differs based on that and very honestly, every person, I mean, if I'm doing a source code analysis, I'll say binary is bad. If I do binary, I'll say source code is bad. There is a big argument in the industry around this, but there are tools which, many tools who actually do after they are, they do an analysis after the code is compiled or built and that is why for the sake of that reason, I've put it here, which can run parallel to your unit or integration test. So it needs a built code. So let's talk about SAS a little bit more. So how SAS works is that when you have your binary or source code analysis, there is a model extractor. So it understands what your model looks like and there'll be some intermediate representation that it'll do to either understand, does it look, does it form some tables or does it have a different kind of a tree structure? What does it mean? And then there's an analysis engine which finally spits out results for you, right? So it's a white box testing. It's doing code vulnerability analysis. It looks for data and control flows or it could look for code execution parts or it could also do some kind of pattern matching, right? So there are some static analysis tools which also do a very basic secret scanning work also for you. So they match against certain patterns which are already fed into the tool. And the rule set that it comprises of actually has some common vulnerabilities that are fed into as tests. So it can run that against your application as well. Again, some tools that I've put in, again, a mix of free and paid ones. But the things that you have to keep in mind is unlike DAS tools, this is tech stack dependent, right? Because this is running against your code. So if you're using, for example, Java, you can use spot bugs, right? If you're using, let's say Python, you can use Bandit. But Bandit won't work for, let's say, a .NET application. Security code scan is specific to .NET again, right? But there are also some tools such as checkmarks and Fortify and all who go across tech stack. So they have support across and they're also paid, right? So the commercials of SAS tool actually goes from zero because it could be open source like spot bugs and all. It can go from zero to almost a three bedroom apartment cost. So it really varies because this is a place where people and companies are ready to invest in because they really want early feedback, right? One of the very important things just because of the placement where it goes in the pipeline is the time it takes to execute. So be very clear about that. And when you talk of coverage of tests and all, most of these tools do actually release what all types of tests they cover. So even if you're going for a paid tool, demand to see that, okay? Demand to say what are the kinds of tests or at least the category of tests that you would be looking at. Again, suppressions because false positives, you are going to have false positives even in this, right? And you could be looking for platform solutions. So for example, you might already have some static analysis which is there, try and see if you can integrate these vulnerability detection-specific static analysis to that. This is not the same static analysis as linting. That is not the same thing. That looks at port quality. This is specific vulnerabilities that it will find, yeah? And the reporting I would suggest when you're analyzing, give more importance to debugability because debugging is important. Pretty dashboard is not important here. It is more important that it is more developer friendly. So think about that because you want to react on it also quickly, right? So some report from spot bugs. Again, this is a free tool. I ran this against Java application that I have, didn't have too much code. So you can see that there are lesser, but all the three things that it found were high priority warnings. And it actually tells you if you come down that there are possible SQL injections in my code that I had run this test against. And it actually tells you a little bit about that also that the code that you've written looks something like this. And why does it know that? Because it has got those analyzers in there, right? So it has broken down the model and it actually understands what it looks closer to. So it understood that the way that I've written my code is vulnerable and it actually gives me a better suggestion to use prepared statements or parameterized statements to fix that, right? So it doesn't matter if it is not pretty. It's not a pretty dashboard or anything like that. It doesn't matter. I need to know exactly which line you found these things at what happened there. So if you click on this, it'll actually tell you where did I find that issue, right? And where does it go onto? What is the type of bug? What can I do about it? That is what I need to know as a developer. So concentrate on that when you're looking at reports. Don't get carried away by pretty reports that might come in there, right? So practitioner's tips on SAST, commercials as I said, it goes from zero to three bedroom apartment sometimes even more. So what you want to spend on, think about what is it that you're trying to gain out of it? So for example, many of the paid tools actually charge you because they support multiple tech stacks.  You may not be polyglot, right? And that's fine. If you're a services company, maybe it is better to think about across tech stack. So think or choose what is it, right? And the commercials also go from, like their license costs are per user, per line that it'll scan to per organization. So there are multiple different types of licensing also that you can choose. And there are open source tools as well. The differences that I have seen is that the paid ones which I've worked with have had lesser false positives to deal with. So you kind of have to intervene lesser manually. So there are those value ads that are there. But again, not all open source tools are also the same. So understand, which is this one, that there are some which are only linters. So many might be using SonarCube as your static analysis tool. SonarCube has some rule sets, but very honestly, it does a code quality analysis. It does not focus so much on actual, figuring out that this is the vulnerability, right? So be very, very vigilant of that. And SonarCube is something that you can still put in, like spot bugs can be a plugin onto SonarCube. So you can run both of these together, right? So think about that, go beyond it, right? And IDE support is if you want to shift even more left than the pipeline, there are some tools like checkmarks and all, which actually gives IDE support. So if you have it at the plugin, while you are writing your code itself, you can figure out if there's a problem or not. Cool, so talking about dependency check, how dependency check works is that, well, there are different types of dependencies that you interact with. You will have libraries, you'll have packages, and then the libraries have their transitive dependencies again. So it's almost impossible to do this manually, right? I mean, there are so many dependencies and static analysis, all the other analysis are custom code that you've written. This is not even in your hands, you didn't even write it. There are libraries that you're depending inheriting their vulnerabilities for free, right? So think about how can you automate that part as well? And it is possible because there are something called CVE feeds, so commonly known vulnerabilities. There are different data sources which are there and they all maintain their list of vulnerabilities that are there in known libraries, right? So these are all known vulnerabilities. So imagine, I mean, custom code, at least an attacker will have to do something to figure out what the problem is.  This is like the low-hanging fruit that you can have. So definitely look at this because if you're not looking at it, an attacker is because all this information is available to them as well, right? That exactly what is the problem, what are the vulnerabilities? So it's a software component analysis. It understands vulnerable dependencies, transitive dependencies, and more components. And then many data sources that I said, a CVE is a data source. So if you want to check out CVE MITRE, MITRE, or NVD or their OSS index, there are many others that you can also have, yeah? Cool. So parameters to analyze the dependency check. Again, there are many tools. Some of them are paid like sneak. Dependency check from OWASP is free. So over here, again, it is text tag dependent because it is closer to your code as well, right? And to understand whether it should be looking at a lock file or it should, like it's a gem file, or should I look at requirements.txt or should I look at Maven or Gradle? It needs to understand what text tag you're on, right? So it is important to choose this also based on the text tag that you're getting onto. And again, time, all of these things are common because they're all shifted left, right? So you don't want your developers to keep waiting for this to go on. So it needs to be quick. So one of the things that you can do is that you can have at an organization level, if you have some repositories that you actually get your libraries from, make sure that they run some of these tools so that they know if they have upgraded to the version which is not vulnerable, right? A CVS score threshold is important. So this is something that these tools actually maintain to tell you the severity or how critical something can get, right? So if I look at a report for this, so this is a dependency check report, you'll see that it actually found so many issues for me and it is saying that there are different severities, right? And how many issues did it find in each library that you see here, right? So if I just click on one of these libraries, it'll tell me more details, it'll tell me what issues it found. So CVE details, if you click on this, you'll be taken to NVD's database to give you more information, right? About that particular vulnerability that it found in Apache structs, right? So this is the library, this is structs to library and it found some issues there, right? It tells you what could happen if this CV was executed and somewhere here it actually tells you what is the score of this, right? So some of these scores, the higher it gets, the scarier it is, right? So some of these scores is like super critical, 10 is the highest you can get and they're like super critical. So just go ahead and change it. Like there is no reason that you should not be doing this but in some lower scores, you might choose to actually like say that, okay, threshold over seven is when you should fail the build. Anything before that, I don't care, right? So think about those things and you will be able to set those also when you're setting your thresholds, you will be able to do that.  So if you're using node or NPM modules, you can just say NPM audit and it actually gives you the same report. So you don't necessarily have to run a dependency check or any other tool for that matter, right? Dependabot is also interesting because this is, I mean, if you have GitHub repositories yourself, you would probably know that there's dependabot that is like a bot which will also raise a PR for you after scanning that what you should upgrade to this version because that is a less vulnerable one. Cool, going ahead, quick tips from here. So the whole thing, the whole concept depends on data sources, right? So be very careful of how frequently those data sources are getting updated. There are some which use the NVIDIA or CVE data sources. There are some who build their own, like Sneak actually builds on top of what they have. So definitely automate this. Zero-day attacks are still a reality. So there would be things that are not reported or into the data sources yet. So you still need to work on it separately and think about canary deployments as your place to actually keep checking for upgrading dependencies and seeing if your application is still stable with it or not. Quickly, the next thing about secret scanning, basically there are two types of secret scanning. You could have either a secret scanner as a hook, like really early. So even before you're committing, it'll trigger in and it'll do some pattern scanning or pattern matching and tell you that there are some strings which look like secrets or there's some file names which look like secrets. So it'll throw that to you. So you wanna prevent accidental check-ins and you could have proactive scans of that. What does a reactive scan do? Is that you have checked them. It's there in your repository, but you can still run a secret scan which will go through the whole Git history because many people just think that if I've reverted, it's all good, but Git history is still there. It'll still have the secrets. So it's not that good. So it actually goes through the Git history and it tells you if there are certain things that you should have taken care of. So parameters to analyze while secret scanning basically is something which matches patterns, right? So the better the pattern or the more coverage of the patterns, the better results you're going to get.  So if you're doing a hook, Git secrets, Talisman, Hawkeye are some hooks which are there. Git, Rob, Truffle, Hawkeye and also Talisman are also scanners that you can put on the pipeline itself, right? False positives are very, very possible in this because it's just doing a blind scan with patterns, right? So be really careful of that and see if there are ways to suppress this, okay? Again, give less importance to UI. It's a developer friendly thing that you have to look at. Cool. Quick interruption, 10 minutes time check. Great, thank you, thank you so much. All right, so this is a Talisman report that we ran. It actually found so many vulnerable, like possible vulnerabilities and it actually is telling me that, you know what, there are all these places where you have patterns where it needs to be looked at. It might be a possible situation there, right? And it also gives me shock commits and it tells me if there are, you know, this is the commit ID where I found this issue, right? So this is how your tools would work on the pipeline, but practitioner's tip, keep both proactive and reactive scans, you need both because proactive, of course, it's better because at the developer machine itself, you get to know and you don't even create a commit for it because removing commits and dealing with all of that and assuming that everyone makes a single file change in a single commit, all of that is really not reality, right? So you don't want to get to reactive places where pipeline has to catch these secrets. So it's better to put in the proactive ones, but do the reactive scans nevertheless because they are hooks at the end of the day, someone does a dash dash no verify, it bypasses the hooks, right? So at least you'll get to know when they have entered the, entered the repository and you can at least take a conscious call going forward from there, right? Revisit your custom patterns. This is something that I really encourage because there is only so much intelligence that these pattern matching tools will have. You know what your secrets are going to look like. So look for options to actually put in custom patterns into these tools as well, right? And better still invest in a secret management vaults. Try not to keep like or encourage or have access controls against who has access to these secrets. So that is the best prevention ever, right? So try and put investment in vaults, but again, you never know someone was copying something, forgot to remove it, checked it and pushed it and you have the secret in your repositories, right? Cool. So the last part of this that I'll be talking about is that there will be apart from the code part, there's also the containers that you have, right? And there are images in the containers that you're using. So your pen testing team would also be looking at what that image is and how secure that is. And they will be looking at scanning some configuration level stuff at that point, right? So where would you put that if you had to put that in the pipeline? So you definitely, you can put it here, but it's too late because it's still deployed on an environment, right? Can you do it earlier? Can you do it before packaged? No, because you need it to be packaged, right? And that's where you can have your containers. So a container scan will come between your package and your deployment, right? So you can put container scans here and there are two types that I'm going to talk about. One is image hardening, which is closer to saying a SAST or static analysis for your containers and a component analysis which is closer to dependency check for your containers, right? So there are two things that you can do over here. So within container scanning for image hardening, there are like, what it basically does is it checks for configurations, right? So this is from Dockle's site that I took. So there are things like CI's benchmarks. Again, if people you're working with any kind of infrastructure, whether they are containers or clusters or cloud or any network or anything, do look at CI's benchmarks, they're excellent. Again, free open source guidelines which are their best practices which are listed. So some people took the brains and automated that, right? So there are a couple of tools in this area and I think that we are still getting better at the range of tools that we have over here. And it basically looks at auditing, system hardening, compliance related things, right? So it's looking at those parts. So there are multiple things that it can do, like for example, are you using a trusted image for your containers? Are you, do you have access control setup? Are you using a root user to set the containers up or do you have a separate user for it? So again, you have tools like Dockle, Clare. Dockle is new but it's growing and I think it's growing really well. So you get a really good report out of this as well. So I'll just quickly show you a report of Dockle. Yeah, so I didn't have much in my container but it says, so I didn't have anything critical either but it says like I created a container using root, right? So it tells me don't use root or something like that or don't avoid using latest stack because latest stack doesn't specify to a version and things like that. So it actually does a scan on the kinds of configurations that I have. It does a compliance understanding or an auditing at that level and it tells me how can I harden my image better, right? The next thing is about component analysis which is closer to dependency checking in containers. So Trivi is excellent if you ask me. Trivi is open source again. It recently got into Aquasec if you've heard of Aquasec. So they have, so there are like you, there are many things that you can be benchmarking against. What I suggest in general, whenever you do any spikes, do it on actual code, not on benchmarks which are already there because all these people will always give you benchmark reports but do it on your actual projects and you'll see the difference, right? So the CVE data sources that they use could be different. Some might use the ones which are freely available. Some might use only one. Some might actually coagulate multiple and put it together. So the data source again is important because that's what it learns from. It's about dependencies, remember that, right? And there are other tools also. Clare is also good. Ankor is good as well but you'll have to have some learning curve to get to it. So quick Trivi report would look something like this where you see all the CVs that it actually found. What is the CV ID? What happened? What was the problem? It actually spits that out right there, right? So that's Trivi for you, that was Trivi's thing. And some tips around this. Consider time, choose what you need to scan. So the multiple things that these tools give you choose which ones actually make sense for you in your context. Scanning for base images and orchestration scripts, if you have them, you can actually push the test even earlier in the pipeline. You don't have, like base images doesn't need you to package. Base images are already packaged. You're probably building on top of that. So if you want to scan your base images, scan that much earlier, that's also possible. Unless you have a custom image completely from scratch then you test it after you've packaged it, right? And orchestration script level, configuration tests and all of that you can always put earlier as well, right? For me it's just last minute. Yeah, just one minute is all I need. So we talked about this, right? But it's a dream now if we hear that there's so many false positives, so many things that can happen that can go wrong with it. So here's my point. It's very easy and this is from experience that I'm speaking. It's very easy that you get frustrated with seeing so many false positives and saying that this, oh my God, there's so much of manual intervention and everything. It does take manual intervention. It's not that easy to set it up when you go with it to begin with. So look at, if you have red bills, they're going to stop. They're going to stop the bill going forward, right?  So what I suggest is do a catch on error, right? So in Jenkins you can do a catch on error. So let them fail. Don't take them out. Our first instinct is take them out of pipelines. Don't take them out of pipelines. Let them stay there. Don't stop your bill till you're confident of that particular step, right? If you're confident of container component, then start feeling it. Then start feeling the deployments going forward, right? But if you're not confident, let it feel on the pipeline, let it be red, let it be a radiator, right? But don't stop the bill going forward, right? So you need, the other ways is that you can, you can short circuit or you can just break this pipe over here, but let it stay there and have patience and discipline of coming back to this and figuring it out, right? So, and just last few notes, there are more, there are more things that you can put in your pipelines beyond the ones that I talked about. I would recommend that you go to my colleagues repo as well, it's there in this slide deck, where he's also put in more types of tests that you can be doing. And this is the pipeline that I used for my demo. There are many more strategies which actually go into pipelines. If you've heard the very famous word of DevSecOps, which is about embedding security into DevOps, it is much beyond pipelines. It is only the beginning that you would put tools in your pipelines. So keep that in mind. There are some strategies that you have to keep in mind about how you release, how you deploy, what else should you invest in and the whole culture and practice around that. So that's me, thank you very much. All right, awesome. Thanks, Arani, that was great.  And I wanna again thank Arani for sharing her experience with us today. She will be in her VIP room for the next 60 minutes, hopefully more. So you can please take your questions there. You can interact face to face with her.