This is my talk.  I'm adorable, okay?   I promise. So when I tell you those really harmful, terrible things that I'm going to be talking about, let's just remember the kittens, okay? Title of my talk, steal everything, kill everyone, cause total financial ruin or how I walked into misbehaved. Quite simply, it's because of the security fails. It's like I'm going to explain to you that the physical security and stuff, you know, is one of our biggest weaknesses because people can understand two-dimensional versus three-dimensional when they're walking up to the front door. Jason E. Street, I have lots of letters behind my name, I promise. Let's start off with who I am. I've got a day job and a night job. My day job is I'm the AVP of information security at a financial institution. My boss is going to love this on Monday. What I do is I work in a cubicle with a lot of cool action figures around it. I monitor firewalls. I watch IDS systems. I build out our infrastructure. I find more creative ways to secure it and to go after people who are coming after us. I do all the day-to-day blue team stuff. My main job is blue team, is defense. My night job is the CIO strategy of one solutions where I do pen testing maybe like three times a year and stuff. You know, it's like basically I do speaking engagements like this around the world. It's like I've written a book dissecting the hack and I also do some other writing and that's what I do at night. I respond to incidents during the day. I create incidents for other people at night. Best of both worlds. I love these pictures because you see the first picture with the baseball cap. That was me standing outside for an hour in front of an industrial park building, a security facility on a Sunday with no traffic and the security walked by twice and did not think to stop me and asked me what are you doing on the sidewalk just watching our building. He didn't put it in his report either so bad on him. The second picture you know looking dapper in the glasses is actually me going to apply for a job. Yes, I'm wearing a black hat collared shirt because I like to come with warning labels and I did not get the job unfortunately. I was way under qualified for that one. I didn't get their data so you know win-win. These are my two favorite pictures of engagements I've been on. The one I'm wearing the I'm a liability shirt I think is the best one because I stole a car in that shirt. I was at a hotel off the coast and the valet gave me the car and I had explained to him I can't get in this car right now and he's like why is this because I'm stealing it. It's like they paid me to do an assessment. I'm a liability and yeah it took him a while to figure that out. So finally I had to say you might want to take this back. I think the owner is going to want it. The second one the next one is my favorite. One of the most secured facilities I've ever seen in my life right across the street from ground zero SWAT teams you know with canine units with their machine guns walking through the concourse eight security guards in the main elevator lobby and stuff not including the business lobby. That's me in the upper floors wearing an actual valid badge and a shirt that says your company's computer guy. I like that. I like that picture a lot. We'll get more to that story in a little bit. So I do have a CISSP. I think the code I think say that I have to put a sun's new quote in my talks. There it is. We're in the intro halfway through so far so good. We're going to talk about the one fact that we have to face when we're dealing with this subject. We're talking about the two rules that I go by when I'm doing an engagement and the three outcomes from those two rules and hopefully a good conclusion discussion. Let's face it. You're going to the awards ceremony right after this but still we can we can hope. Why this talk. I gave a talk last year on the 36th strategy was talking about the beginning of social engineering. It was talking about things that you could do to try to get into the buildings. That was the part one is quite frankly I got some feedback afterwards going like man Jason that's some basic concept stuff. You know it's like you weren't showing any kind of NLP or because I can't. I am not a professional social engineering expert. I don't know about NLP. I don't know the psychology facial recognition mind ninja techniques. I still get in. I have a hundred percent success rate of getting into facilities when I'm doing a social engineering engagement. So it's not that I'm that great trust me. Anybody will tell you that it's our security is that weak. So these are educational and hopefully in a funny way kind of talk just to give you an onset of where to go look for more stuff and then hopefully have a good chuck away or doing it. OK. You're not going to learn anything new but hopefully you'll remember something that will make you go look at something else and you'll be better for it. So this is part two because now I'm not talking about the social engineering part so much as this is all the damage I'm going to do after your security guy let me through the front door because number one fact I'm getting in. OK. This is the I took this picture. I kid you not. I'm going to meet the guy for the first part of our meeting and as soon as I opened up I got into the concourse and I saw the door the employee door for the secured area.  I walked right over pushed one three five. Guess what. I got in. You just I would have tried five three one or three one five. You know I would try but look see how they're rubbed off. I mean it's just look at the guy's face when I showed up 10 minutes before our meeting and no one knew I was there. So that was fun. Here's another one. I went to go to apply for another job and when I'm on these engagements I like to be bad. So when I signed in to the receptionist I stole the pen. I'm a bad guy. It was what we do. So as I go as soon as I finish getting the pen and signing in I asked to go where the bathroom is.  It's just because I get lost very easily and I will wander buildings looking for that darn bathroom for hours. She can't believe where the things I can get into. Well I'm going through and I actually happened to stumble into the security area part of the employee area while I was looking for the bathroom and I found the employee entrance and this is like the security guy at this facility actually bragged about their million dollar security system and I looked at the door and I saw this little rod thing and stuff you know that was the what was latching the door with and I was like only if I had a condom or something you know that protect that little rod and keep the door from keep the door closing and then making it latch and then I remembered oh wait I got a pin. So I took the pin that I stole put the cap on the rod the door shut perfectly and it didn't latch. So I leave it's like I come back in about 20 minutes or so it's still there. I'm now in the security facility and no one knows. So that was fun. I am not a actually we're right here. Okay. So I'm not a master locksmith.  Okay. If your people will let me through the front door. Okay. I don't have to be a massive ninja coder which I'm not. It's like if I can just steal the hard drive with all your data. Here's some of my master lock picking skills in action. I'm I'm terrible with the lock picks but I'm awesome with cardboard. So here's another key. I love forging emails and putting them on iPad. The key is to put them on iPad. If you forge an email and print it out they're going to look at you fake. Oh this is you just you just type this up. You put it on an iPad. The blue hyperlinked stay hyperlinked and also it's like it's on an iPad. It's magical. You must be telling the truth. It's like so it's like so they're going to go and say it's okay. It's like so I was up in that secured facility in New York. The network guy noticed an unusual amount of traffic coming from the CFO's assistance computer and it's going to their main server and it was meek and so he comes over and he asks it's like what's going on. What are you doing? I start telling him exactly why I'm there. I spent two hours on Google creating this email making it sound like the owner the new owner of this company was upset and sent an email to the other company that he owns to send one of his guys out and to go and look at the network and I made it sound very political. I made it sound like there's urgency and that they it was supposed to be surprised so no one knew I was supposed to be there. So I showed this to the the networking guy well he sent me to his office we went to his office and we talked to the CIO for about 10 minutes and the employee then started to escort me around to all the other computer desk and stuff you know so I could plug in my malware and I had an employee escort so I had to be okay. So it's like I actually can finish the rest of the engagement and stuff you know having someone help me and make sure that the people knew I was okay to be there and plugging in my USB devices and doing whatever else I needed to do so I really love that email. I've got two rules but guess what looking for PCI is not one of them.  Okay remember the kittens so this is where I got my my two rules I got them from Serenity which was based off the series Firefly which Fox cancelled Midi Dynafire and the two quotes are very simple I aim to misbehave and let's go be bad guys that's it I'm just trying to do bad to team it up it's like you know red team it's like don't act surprised when we try to kick you below the belt it's like bank managers are still being kidnapped today taken to their home their family held hostage overnight until they go open up the bank for bank robbers that's not funny that's real this stuff still happens another thing is this is one of these things that we people talk about this is not a new concept what we're doing this is from 1992 the movie sneakers it's like so people hire you to break into their places to make sure no one can break into their places it's a living well this one's old now because it's not a very good one it's gotten pretty good now business is pretty good with this but this is a concept it's not new it's something that we still have to keep revisiting stuff you know better people than me talk about it a little bit more technically and stuff you know like I said I'm I'm the comedy relief on this but let's keep going so another thing we have to understand is management is not proactive they are reactive so Dana Irwin said in 2008 the best way to get management excited about a disaster plan is to burn down the building across the street hello everyone like to introduce myself I'm the fire so what we're going to get to now is we're going to get to the fun part and the fun part is talking about all the different ways we can start those fires okay I love this one this is this is what I call the trifecta of bad because yes I've stole the phone or cloned it yes I've got the laptop 30 laptops unsecured in this facility they had no laptop lock cables because they were secure by the time I did the exit interview I started seeing laptop lock cables which was good for them also the badge because you know my arms may get tired I might need to take make trips so it's like uh so they had me an employee badge I appreciated that okay I am I do feel bad about this one um because I am a CISSP advocate of ethics so please no one report me let's make this off the record I'm sure no one's watching um not about the laptop because I have no problem stealing the laptop I mean the guy left the cable on it for me he was just giving it to me and I'm not talking about the screwdriver because I need to steal something maybe you know that was bolted down because you know I like to be thorough um I was a little hungry and I stole one of the cookies I'm sorry okay let's go on um I love this because you know people expect security not to be that thorough so they get their laptop lock cable they're told to fasten it to the desk but that's hard you have to bend down so uh let's just lift that cable over the the desk and no one's gonna pull it and you know what most security doesn't uh pull the cable to see if it's actually secured but I'm not security I'm the thief I'm going to pull the cable I'm gonna try to steal it also kudos for this guy because he had it for uh firmly attached to the uh the desk he had it uh he had it locked to his laptop but I'm telling you when it's the code zero zero zero zero I'm gonna try that one I'm gonna try one one one I'm gonna try nine nine nine I'm gonna if you're geek I'm gonna try zero zero zero seven so sorry about that one um also they like to move the one like the last number or the top number they'll move one in either direction and that's it so that way they can just go deek I'm unlocked deek I'm locked I'm gonna try those also when I'm in engagements I'm going through all your drawers wait hold on that didn't sound right uh I'm gonna go through all your desk and your cabinets okay and I'm gonna be looking for stuff because nice honest and co-workers are not gonna go looking through your desk I'm not a nice honest and uh co-worker uh this guy had his laptop locked totally correct everything was right and then he put the keys in his top drawer so now the non today I still hit his laptop but now I have a nice really shiny laptop cable and stuff you know I can protect from someone stealing it because I hate it when they steal my stuff that I stole I'll always why this picture was in here is because I stole the iPod because that's like totally freaking retro how awesome was that this is another trifecta it's like I stole the purse I stole the car keys and yes I stole the phone let the record state I did not steal the lunch okay I felt really proud about that but but now let's hold on let's let's cut it for a second I took the car keys took the driver's license out of her purse I then go to the parking lot to find out what car it is I unlocked the car I go back and put her car keys back she comes back after work I'm in the back seat with a gun telling her that I've got a driver's license showing her that I know where she lives that I've got people there that will kill her family she does not go back into that facility steal all their data that I need and then come right back out and that we're tracing and we've got our phone cloned and we can monitor it employees need to know that their personal belongings are theirs but the impact can be severe for them as well as the company that's why they need to secure their stuff now let's remember the kittens real quick okay when you have this many frowny faces on a slide you're just effed okay it's just game over you literally gave me a blank check just steal your your credit and your identity and trust me my credit sucks so I'm taking it you know thanks for leaving the social security card there because it's got your signature on us I know exactly how to forge it it's like that was very helpful not many people are that kind so oh when I stole the first car the guys were cheated and let some people know that I was going around and doing stuff like that so I said we'll screw you two o'clock in the morning I walked in grabbed three Mercedes Benz and a beamer and just took them with me less than 66 seconds so Nicholas Cage beats that the look on the guy's face when the manager's security face when I walked to him and I dropped him those four keys was priceless I wish I could have included the picture but it's on my desktop at my home so so some countermeasures employees need to know that this stuff matters for them as well make sure they're locking their desk securing their property they secure their property at home they secure their property at their in their car they need to secure their property at work also no tailgating you got to be sure that they understand that they shouldn't tailgate it's like they shouldn't because you know what I'm doing I'm coming in the wheelchair and I've got like four books and it's like oh man Jason you're a douchebag and I'm like yes I'm a bad guy I'm trying to steal from you do you really think I care that you're going to feel lesser about me because I'm not supposed to be in a wheelchair no I'm evil it's like so what I'm going to do is like and trust me when I go up to that door and I got these books you're really going to be the asshole who's not going to let me in the door I mean seriously no you're going to let me in and I thank you for that your employee is not going to your employer is not going to but I will also if you see some see something say something you don't have to personally tackle the guy if you think he's suspicious okay you do have to call security you need to start empowering the employees to understand they are part of your security team and they need to start acting like it so yeah here's the real warm and fuzzy side we're actually going to talk about how you know to kill everyone because that always brings up a crowd on a Sunday night this is uh taking pictures at 2 30 in the morning I'm in a hotel somewhere uh different hotel than the car and I'm inside a mechanical room I'm wearing Pepsi pajama bottoms over some cargo pants with some really bad things and a white t-shirt and I'm barefoot because I took all my clothes off in the bathroom and the guest area of the hotel and changed into that and then started walking around and see what I could do I could do a lot because you notice one important fact in this picture there are no padlocks on any of the switches I will tell you this right now I've got some OCD like you wouldn't believe okay if that switch is on I'm turning it off if that switch is off I'm turning it on and if by golly if there's a red button I'm pushing it twice okay that's just how I roll now I want you to understand I'm not a total jerk okay it's like because yes I'm going to start a fire in this room and yes it's going to have some poisonous chemicals in it so the smoke will go through the ventilation system that's right there but I'm not totally terrible because I mean it's 2 30 in the morning who wants to get woken up at 2 30 in the morning listening to this ringing alarm sound going off so I'll silence the alarm system for you because it's like I mean I don't want to be rude the only thing worst and having that alarm going off in your ears and stuff you know someone throwing cold water on your face when you're trying to sleep I'll turn the sprinkler off system off for you too okay it's like I don't want anybody to get all you know wet and drenched and stuff you know there's a fire going on that'd be dangerous oh wait hold on yeah maybe not okay so another place that I like to I think it's great to kill people is the kitchen it's like this guy didn't even ask who I was there but you know most people don't so just to bring that home here's a nice little video is there any law enforcement from Malaysia in here okay this was okay good this was a video that I took in Malaysia in a Malaysian hotel I was wearing this shirt and I'm in Malaysia I don't blend well so let's see what happens here we go I didn't edit this video because I don't want you to think you know shenanigans it's like you made it yourself look poor or something like that but no so you'll get to see me doing exactly everything that I did including right here where I should have turned the other way but I turned this way but I didn't know what the building was like so let's walk down this corridor first yay I'm walking as fast as I can I'm walking pretty fast it's just a long border we'll say and if I wanted to steal some tables there I go I was like wow that was a let down I'm sure I'm impressing people that are in the audience right now so I decided to keep going I'm a hacker we don't give up the first try right so now if you get motion sickness or sea sickness take gramamine or look away for a second okay because this gets me wasn't joking so I come up against this door here and I'm thinking oops there we go so I come up against this door and I'm thinking oh this is awesome the reason is because it's secured and it's got stuff in there that you want protected so you put a padlock on it but then you don't padlock it so one thank you for that what could you be protecting I don't know let's see here oh I did not go in there with the Newsy or an AK-47 I did not bring C4 with me I just walked out of that closet with napalm I just walked out with poison so let's see what I can do well first I got to find a place to do that that's going to be a long search you know looking for the proper place to deploy this kind of stuff let me turn around and oh I'm in the kitchen that was quick so let's walk through here everybody say hello to this guy he didn't say hello to me the jerk I'm if it was a little bit later at night I'd be you know tampering with right there's the refrigerator for the food supply I would destroy your food supply even if you detected it was poison it would be useless you'd have to destroy all of it that's some that's some coinage right there here I'm going into another room I could have gone to some of these other doors I wasn't really trying especially since I didn't have permission I mean I'm in since they didn't know at first it's like they said it was okay first afterwards here's the mechanical areas this is where I started my mechanical fires using the napalm you notice those two guys there so I have to use social engineering counter measures let's listen my counter measures hey how's it going it was going okay and then I kept moving so here we go through the rest of it that's just me showing you more places that I would spread the napalm I like saying napalm that's what it sounds like one of the other things you notice that they protect guest information really well you know in the computer systems you know you can't go to the front desk and ask where someone's staying but obviously you can walk into the kitchen because every person their room number and their name is right there for room service so that's pretty low tech now I'm going through this and I'm thinking to yourself because like you're saying well Jason all you're doing is walking around the freaking place what's that well basically first of all dude I told you I was showing you the physical stuff not social engineering but since you asked let's go try some social engineering because let's see what happens if someone notices me so I'm going to go talk to the head chef and the manager of the hotel you have a Wi-Fi cable so I asked him if he's using Wi-Fi or cable I got an iPad and I've got my hacker shirt and I was like using Wi-Fi I'm questioning him the stuff you know and he's saying he's using cable that's just a corrupted photo I love the way they smiled and like the guy in the back window was just like you know photo bombing mean stuff you know going what's going on with that guy it's like and then I just left that was it so that's how easy it can be and it's like and we talk about social engineering it's just easy as just saying how's it going and stuff you know and talking to someone people don't expect bad things to happen until they happen so some of the counter measures one of the key ones that I could not stress enough is create a code word make sure people understand that first of all make your employees understand that this stuff happens workplace violence happens I mean for gosh sakes I got this information off of workplaceviolencenews.com it happens so often they've got a website for it for gosh sakes that's depressing okay so you got to understand that that happens so set up a code I tell people like especially with receptionist code oh my god he's got a gun run panic we're all going to die is not the best code okay it is effective it does you know raise a thing but it may not be the best I always tell them to suggest something like a code periwinkle Mr. Perry Winkle to HR Mr. Perry Winkle to HR and I'm hoping that someday someone institutes an actual code periwinkle because I think that's just funny saying periwinkle another one is conduct routine safety checks not just safety checks of your equipment but of your people as well when I walked around for an hour I noticed one thing at that facility there was this one door that I could easily jimmy and it had a camera that was right over it but I couldn't tell by the angle because where the other two cameras were spaced if I walked diagonally from the other parking area they wouldn't see me except for that one camera and if that camera was angled at the right way I could totally bypass it so I talked to the former head of security there and I told him it's like dude it's like this is where I can get in he's like whatever it's like come with me he takes me into this office the security office it was empty showed me the computer screens the TV monitor screens they were all turned off he turns them on the one camera that was not working was that one I looked him dead in the eye and I said in all seriousness like oh I guess I wasn't the only one that had that idea you may want to check your inventory I did mention he was the former head of security at that facility okay good okay so let's talk about you know financial ruin let's talk about the espionage and I hate to break some people's feelings and stuff I heard some people's feelings and just say it's not just the Chinese okay 70s the 80s 90s it's like the French were doing awesome with it so sorry to you know to insult actually I'm complimenting my French friends because they did a great counter espionage thing with the CIA and stuff back in the 90s with the Boeing incident you can Google that one CIA wish you wouldn't so that was fun so let's talk about some of the things you can do there once again this many frowny faces not good because you know what I'm an environmentalist I am do you know how many poor senseless trees die every day due to those printouts that you leave beside the printer well you know what they will not die in vain when I visit I'm taking all of them I'm going to liberate those trees I'm going to liberate all and you know what I'm such an environmentalist I will take the ones that are still printing out just to make sure you don't forget them those trees will not die in vain when I'm there it's like you know nothing I like and this is so sad this is actually a Dilbert comic strip is that they still use shred bins to put all your you're telling me all your confidential data all the stuff that needs to be shredded let's put in a big blue bucket this is all the confidential and this is done in D.C. and this is done in financial institutions this is done in like DOD contractors offices and what my favorite is the DOD contractor's office it's a secured area the office the office the actual offices of the executives they're actually secured locked where security cleaning crew can't go in because of all the top secret data so what do they do at night they put the blue bucket outside their door yes that's awesome I mean I mean I'm sorry it's awesome for the bad guys oh dude yeah when I get to the point where I can just stick malware and into your hard drive it's just gonna be a fun night for me not for you that really yeah step con get with it one thing we're going off your workstation is when you see that USB drive in your exchange server it's not gonna end well for you okay I know where that USB drives been you don't want it in your exchange server okay and I mean and you're thinking it's like what kind of damage is that you can do going after our exchange server in that case should be Gary but we can go and say well then how about your accounting server me and the 25 other employees that are also me they're now getting pay checks from you say well it's okay it's not gonna be too bad or I could just do a wire sniff this was like from my part one talk you know just do a wire sniff for your traffic sniffing passwords are hard you got to configure all the stuff of Linux you got to get the wire like I said I'm not that technical I'm not that you know bright it's like a well and I just get them off your monitor okay I love this one I actually tried bracket leave blank bracket first I gave them the benefit of the doubt okay and yes it was just hit enter this is my favorite of all time you know why because this was at a pharmaceutical bio whatever research lab and stuff you know where I'm supposed to be doing with rocket scientists right the password first of all they shouldn't have written it down at all but the password was that scratched out was actually an alphanumeric special character password it was very complex and it was hard so they scratched it out and put it to welcome so and it was all lowercase I tried the capital first because you know they're rocket scientists the one thing worse than seeing me in pepsi pajamas you know ask my curio is actually seeing me in this suit because if I'm in this suit I am out to screw you over terribly okay because I'm wearing my best to do I call it the best to do because I think it sounds cool and I'm reliving my childhood if you want to know more about the best to do and all these little toys it's in my part one talk that I did last year and it's like but those uh but now I want you to know I've got a best to do 2.0 let's let's see some of those things okay I've got some video recorder usb pins right here none of them are keeping one in my pocket I'm going to actually be going in and leaving them in your little cupholders that you leave so I can record you logging in your passwords carrying on your conversations things like that so that's awesome if I'm the tech guy I got my nice little handy 8 gig usb flashlight video recorder that I'm still your data off of and as you remember the little bouncy Dramamine that was because it was taken on my 4 gig audio video recorder watch when I walk into your facility I'm a walking talking Google streetcar okay I'm capturing everything I can now I got another device since then too that's to my 2.0 vest this was something that was given to me by a three letter agency in DC I'm not the only reason why he gave me this this device and stuff you know which cost billions of dollars research he said was that I was to never talk about it in public so this device he gave me is actually a usb keystroke logger it's undetected by any antivirus she can plug it in it's very streamlined it's undetectable stuff you know it's very hard to spot when you actually plug it into the vice and it records all the keystrokes you're right I'm lying I got it off a think geek think geek I like to put this for you know for the qsa's and for your for your executives you know that you want to talk about this slide students have you know and tell when you get back and tell them about these things let them put it in a different way that they understand a little bit better the risk matrix available at a geek and gadget website well we discovered that's a near certainty okay being able to log the CEO's keystrokes yeah I'm gonna go with catastrophic on that one now you see all these other devices you see all these pens you know these devices those were acquired it's like you know from a very I mean you have to be a select group of people okay to be able to get access to that kind of technology I mean I think everybody is familiar with that kind that kind of access I think everybody here has that access it's called frequent flyers I mean you talk about hackers getting this kind of data okay I'm an accountant I really hate my boss I really hate my job I want to go somewhere I want to steal a whole bunch of stuff from the company first how can I do that oh I'm on this flight oh look sky mall oh I can put keylog stroke keystroke logging and spyware on his my boss's computer oh I can you know have a USB recorder and stuff you know pin and take video of our company secrets and yes I can actually have a voice recorder so I can record our top secret confidential conference meetings this is not hard that is one of the biggest things you know you hear I see these talks and it's like these guys are like the rock stars and they're like they're super leading stuff you know and they deserve all the credit all the stuff but I'm telling you it's not just that I'm the reverse of that I'm the guy saying it's so easy even I can do it okay it is like it's just the general stuff people are so busy protecting their stuff from these very high level attacks they're forgetting oh SQLI oops sorry Sony you know it's like it's sometimes it's a low-hanging fruit it really is the low-hanging fruit they're going to go after so you've got to be protecting that as well you got to be protecting from these kind of threats as well this is one I love this one I took these pictures this is the pony plug from pony express I took these pictures at a bank branch out on the out on the west coast and I did four branches four attempts four successes after the fourth one they told me to stop the reason why is because I walked in I was wearing a blue DEF CON shirt work shirt I come with warning labels and I told them it's like I'm here to check we have been having brownouts at the corporate office and we need to check to make sure that the power fluctuations aren't affecting your operations here so what I'm going to need to do is I'm going to plug this device into your here plug into the network so you can take the readings and report back to the home office exactly what's going on and by the way I need to go in and check your make sure all the computers have proper power surges and UPS units working I used a face false name that I had no idea your identification for I used a fake company and a fake phone number I signed into their vendor log if I would have come in there with a ski mask and a shotgun every single person would have reacted exactly the right way they've been trained to handle that they were not able to they did not expect the geek factor and they walked me through the teller area the drive-through area and through the back rooms where the actual money is not the shiny little fault thing but the big saves with the actual money in it what kind of damage could I have done what I did do was I plugged in my pony device this one with the power unit and seven I see the power UPC on the right I like that one the best because I had to get the bank manager to get out of her seat so I could plug it into behind her desk and what I do right after that it's like I can I don't have to go to my car I don't have to phone home I go to the bank lobby and I've got backtrack five on a zoom tablet and it's like I've got it already connected to the pony express I'm pawning you before I even get out your door okay so what are some of the countermeasures there's only one major countermeasures people okay and that quite frankly is just going to be stop printing what happened to this paperless office for gosh sakes it's like make sure you're doing proper DLP making sure you're talking about we there was a recent report about how some of these data leakages are mostly coming from insider and threats from the actual employees themselves so make sure you're watching you're doing dual diligence making sure that not everything is being shared open so so now what can we do like I said I'm the blue team I like it when we win I love I am I kid you not I am rooting so hard for the good guys when I go on an engagement okay I mean I look at some of those employees sometimes I'm like you've got to be effing you're believing what I just said seriously and it's like and then they let me in and I'm like oh my dude obviously I was a bad guy it's like so we needed what do we need to do though we need to educate empower and enforce our workforce our employees and the best way to educate them is to stop this one simple phrase stupid users stupid users clicked on an email stupid users went to a website that weren't supposed to go you know what if I'm in the security department stupid me for not educating my employees properly on how to handle those kind of threats okay and another thing is if I hire an employee and on the first day they don't even have a driver's license and on the first day of work I tell them here's the keys to my Bentley go do some deliveries and they break and they crash that car who's the idiot the one that started driving and the one that gave them the keys we're giving them technology they don't know how to use they need to start being educated properly on how to use it then when they screw up we can say it but not until then we need to educate our employees and let them understand where they're going to do we also need to empower our employees and by empowering them I don't mean starting a union okay so don't get all upset with me you know management types okay we need to let them know one simple fact they are part of the security team from the CEO to the mailroom you are part of the security team it is part of your job and your duties to make sure you're protecting the company data and they need to know that and they need to enjoy that they need to understand you as information security has access to the biggest intrusion detection system known to man all those employees on the front line they're saying oh that looked weird that shouldn't have happened let me call somebody that's what you need to start doing you need to start empowering them you need to start letting them know that it's required I've got a guy who sends me 15 freaking emails okay a week on a phishing scam or some kind of other thing that he thought was weird and he wanted to he wanted to make sure I knew about it you know what I say every single time awesome thank you very much I appreciate it because that 16th one is not going to be a false positive it's going to be something we need to respond to I'd rather get a thousand false positives from people that are actually thinking about it because if they're sending it to me that means they're thinking about security we do walkthroughs in our facility during our day job and we look under keyboards for passwords I mean at first we actually started finding them okay that was bad it's like but then we started not finding them but we still do it you know why because every time you do that everybody in that area is going oh they're checking for something we got to make sure creating that security awareness without shoving it down their throat that's how you do it that's how you do it and then you enforce it okay not with a baseball bat but oh gosh that would be fun but no it's like not with a baseball bat but with positive enforcement when someone stops me when I don't have a visible badge it says what are you doing what are you doing there I report them to their supervisor and I say awesome job that person did what they were supposed to do that person is protecting our data we've got it where we put a list of stuff you know and our bulletins and stuff you know employee bulletins saying people that got kudos for security they did the right thing they did it the right way and you know what that breeds competition because that freaking susie and accounting she's always getting the credit for doing that stuff well I can do it too you know I can stop someone if I don't think they have a proper badge that's how you enforce it it doesn't have to be negative you've got a workforce you've got a human IDS system out there just waiting to be used start using them okay so as soon as you as soon as you stop saying stupid user and start saying my co-workers in the information security department we're going to start winning so here's some links and there you go


The ERA interim slash land data set is a global land surface reanalysis data set covering the period 1979 to 2010. It provides a comprehensive description of soil moisture, soil temperature, and snowpack evolution over this period. This data set was developed using the latest ECMWF land surface model driven by meteorological forcing from the ERA interim atmospheric reanalysis and adjusted precipitation from the global precipitation climatology project. The data set has been validated against ground based and remote sensing observations, and its quality has been assessed through comparison with these measurements. The data set provides a global integrated and coherent estimate of soil moisture and snow water equivalent, making it useful for initializing weather forecasting and climate models. This article was authored by G. Balsamo, C. Albergil, of Belljars, and others.


Hello and welcome to the session. My name is Mansi and I'm going to help you with the following question. The question says two dice are thrown. The events A, B and C are as follows. A is getting an even number on the first die. Event B is getting an odd number on the first die. And even C is getting the sum of the numbers on the die less than equal to 5. Describe the event A dash that is complement of A. So let us start with the solution to this question. We see that when two dice are thrown, the outcome that we have can be 1, 1, 1, 2, 1, 3 that is 1 on the first die and 1 on the second die, 1 on the first die, 2 on the second die, 1 on the first die, 3 on the second die. Similarly, 1, 4, 1, 5, 1, 6 or 2, 1, 2, 2 till 2, 6 that is 2 on the first die, 1 on the second die and so on till 2 on the first die and 6 on the second die and so on. We can have 4, 1, 4, 2 till 4, 6 and so on we have till 6, 6. Now we see that this becomes the sample space for the event when two dice are thrown and these are the respective sample points for this sample space. Now event A was getting an even number on the first die. So we will see that sample space for event A will be all those sample points where the first one is an even number because we are getting an even number on the first die. So the sample space for event A is 2, 1, 2, 2, 2, 3, 2, 4, 2, 5, 2, 6, 4, 1, 4, 2, 4, 3, 4, 4, 4, 5, 4, 6. Now here we see that we should have an even number on the first die no matter what is the number on the second die and we will have 6, 1, 6, 2, 6, 3, 6, 4, 6, 5 and 6, 6. So these are the sample points and this is the sample space for event A. Now for event A dash the sample points will be all those points which we get by subtracting event A from the sample space. So the points are 1, 1, 1, 2, 1, 3, 1, 4, till 1, 6, 3, 1, 3, 2, till 3, 6 and 5, 1, 5, 2, till 5, 6. So this is the sample space for event A dash and we see that this will be equal to event B that is getting an odd number on the first die in all these sample points. We see that on the first die we are getting an odd number. So this is same as the event B. So this is our answer to the question. I hope that you understood the question and enjoyed the session. Have a good day.


In this module, we shall be studying the structure of Sukuk istisna. You will see that things are getting complicated. We started this course with a very generic kind of module which was general in terms of contents and general in terms of my approach and presentation. Since then, we have learned a lot of things about Islamic banking and finance and we have beefed up our knowledge on Islamic modes of financing and their applications in Islamic banking and finance. So, the things are not as simple as they used to be. Now, we are entering into a phase where we would be learning some serious stuff. Sukuk istisna is based on the contract of istisna. Istisna comes from a root word of staud noonain sanaa. This is why the word urdu comes from sanat. Istisna means to make something, to demand something. Sukuk istisna always is about some construction activity. It's about some manufacturing and similar kind of activities. And of course, it has been quite popular in the context of property finance as well. While the most popular Sukuk structure is Sukuk izhara. Sukuk izhara is popular because it is relatively easier to structure it. It requires an asset that asset is sold to an SPV. SPV then leases it back to the obligor. And this structure gives rise to receiving financing and giving return to the investor. Sukuk istisna on the other hand side is also important, but in the context of large transactions where some construction activity, some manufacturing activity and similar kind of activities are involved. There are not very many examples of Sukuk istisna in the market. However, this is an available option and it has been used on previous occasions by a number of obligor. It must be emphasized that Sukuk istisna and other uses of istisna in property finance are always structured around the forward lease. Al izhara mausufa fiddimma. So forward lease is required to generate frequent returns to the investor. Whenever they invest some money in an instrument, in a bond, in a Sukuk or any other instrument, the expectation is that that investment should start generating some return. If we use istisna in its plain form, then the possibility of receiving returns before the asset has been constructed is not there. So to generate returns, forward lease structure is built in the structure of Sukuk istisna. In certain cases, the Sukuk holders or investors may not require periodic payments, periodic returns. In that case, the structure can be simplified by way of excluding the forward lease agreement from it. i.e. al izhara mausufa fiddimma will not be required. But overall, when we look at the structure and we are going to see it now, it looks like a monster. This is a very complicated structure. But unfortunately, this is how the things are. Let me explain this structure bit by bit so that you understand it properly. This is basically the transaction flow, how the transaction takes place. Step number one is that the Sukuk is issued. The issuer is in this case, this SPV. This SPV issues Sukuk and these Sukuk are bought by the investor. It is interesting that in this case, we are starting with Sukuk issuant. If you remember, I said that for a Sukuk to be issued, there must be an asset preferably in existence beforehand. In this case, there is no reference to the asset at the time of issuing the Sukuk. In fact, there is reference to the asset, but that asset doesn't exist at that time. So, the certificates of Sukuk, they are sold to the investors and investors, of course, they pay money. So, that investment comes into the SPV to the issuer. So, that is number two. Now, on the back of this thing, once the Sukuk have been issued, the SPV would then enter into Istisna, forward lease and service agency agreements with the obligor. This obligor, remember, is looking for money. So, issuer would enter into a number of contracts with the obligor, Istisna agreement that would govern the construction of the asset. And pursuant to this Istisna agreement, the issuer would be paying installments of money to the obligor, which wanted to have financing anyway. Forward lease contract would allow the issuer the SPV to receive forward rentals from the obligor so that it pays frequent returns to the investors in the Sukuk structure. Now, once the property or whatever is being constructed, that is actually constructed, then what happens? But I have explained this Istisna agreement is number three. Then of course, sale price in installments, i.e., the installments, they go from issuer to the obligor, rental payments and periodic distribution of return to the investors. Then we have the phase of delivery of asset. The obligor has completed the construction, completed the manufacturing and that asset is then delivered to the issuer. The issuer of course, would like to sell it in the market or would sell it to a subsidiary of obligor and would get the price. That price would then be used to pay back the money to the investors i.e., the invested money which the Sukuk holders invested in this structure. So, this is how a Sukuk Istisna would look like. This is a generic example of Sukuk Istisna and it is already quite complicated. If you Google, you will find a lot of Sukuk Istisna structures which look even more complicated.


ell you Travis worked his tail off helping us gather those horses that were running all about town since 2017 and we finally did it I took a week and a half off from work all the whole time I had to get clearance from my boss to take off from work to do this as a volunteer and Travis got paid I did not so I'm not looking to get paid but I'm just telling you this is what your select pour does this lady and Sharon and Rick everybody mark two you know we put in so many hours it's exhausting and we're not complaining we just want you to understand that horse issue I just got an invoice it's like I don't know $2700 and the meter is spinning we're boarding four horses and we're in negotiations trying to figure this all out because the owner has some struggles going on where they cannot reach an agreement on a court and so the court is trying to work this is so complicated so common deer taking someone's property which are their horses and it's not someone's dog Jeremy take care of the dog feed them with your dog these are horses and then horses that were not vaccinated that were not properly cared for so we had to get a vet to come out and vaccinate them and treat them and test them for all these diseases there are four horses I kept the stallion running around jumping on their mares serious stuff they can injure them they can injure the person all these horses were out of control we were fortunate to find a stable for three of them and we were so fortunate I kept the stallion at my place with my cattle and I dealt with them and I dealt with these horses twice before I took them out of my place and just trying to solve a problem as best I could but I couldn't take them anymore because it was such a struggle we finally found someone to take the stallion and that's an ongoing issue so I just want to tell you these things are so deep they're bottomless you know I would like can I I wanted to underscore what's going on it is statutorily one of the kinds of items that is appropriately discussed in executive sessions some of you are probably wondering where is this under the hall of reason it's not there it's inappropriate to be talking about a level of sensitivity that Don is talking about while it's happening it's a legal matter if you place the people under the banner and statutorily protected as appropriate executive sessions so you so people who wonder what we do in executive sessions from every point it's kind of fine but executive sessions it's not appropriate for us to share it's I really we have heard from everybody that number one you really care about moving ahead with the treasurer position and we should move heaven and earth to try to fill it as soon as we can and we hear you and that you weren't satisfied with the way we did it before we hear you we've heard from you that we should really seriously think we've heard some support and for the DPW position and some feeling like we should really rethink it a little bit we've heard so I just want to say we've heard and I would like to close the hearing and close this meeting out if it's okay thank you very much is this a new matter no, I just have one thing to add just a request John, thank you for all your work first of all because that's been kind of an ongoing content thing call you every day it's a big deal and speaking with the father I guess the one request that I would have in terms of the board's continuing use of executive session would just to be could we please be a little more clear about under which prom of the statute we're actually using one BSA 313 is fairly broad I'm assuming you all aren't talking about student disciplinary measures or many other things that are in there I think it's important as a practice if it's going to be continued to be used for an hour on either end of the meetings that it's very clear that this is personnel that this is something that's very specific because you know it's it is a narrowly tailored piece of legislation that allows boards to necessarily meet and not have to take notes out of the public view and when you're talking about matters that are concerning spending money creating new positions, things of that nature I think what people are concerned about is that some of these things are happening behind doors they're not personnel they're not something else and that's all I'm requesting and I think what we're hearing from folks is that we just want to know that the things that are happening are appropriate and that are lawyer matters and the things that are very clearly appropriate behind closed doors and that the other things are not happening when we go into executive session Denise has those examples from open reading law printed out and she reads them the appropriate ones they were written by council actually the previous council and we've been advised you don't say you know Rose Peltchuck sitting in the audience she's the only one in our empty select board meetings we're going into executive session about personnel and there's Rose sitting there oh it's about Rose and then we get on flood board forum oh I was Rose in there did she do something wrong? she sped as my Alice maybe that was it you know you cannot be saying that stuff you've got to be really nuanced we've been warned against that we have to discreet we can do it for personnel reasons but we don't go out and say we're going in because we need to have a talk with Rose we have to do that one more hand up in the back there and I'm going to use my discretion to say this is the last one I want to know if our train to be able to carry a firearm that's a concern I hear you we hear you yeah that's something that should be imposed to somebody just getting that crown believe me we hear you it was a really big concern by the select we're just saying we'll just say how Wilson Hughes was trained at that level we never do I hear a motion to turn it that's fine do I hear the second was that specifically part of this animal control if you show us if we train at a higher level because it gives them extra tools and then actually if you're trained at that level there's some positives there's some concerns but we had struggles let's just say with law enforcement being responsive if they hear you're a train law enforcement officer oh okay then so you can hold those horses legally because he is a and he's not going to get the state police in trouble or get tangled up in a mess of our creation or it's less likely of course of course it's so complicated but there's a lot to it and Travis brought up and we again we find out when we explore and it came up I forget who brought it up but law enforcement officer contacted us said so I see that you're doing this and you should know that the league has a different rate insurance rate if you're going to have someone no I don't think we ever told the league about Wilson but now that we know that we need to let them know and I didn't check on you further because nothing happened we have a motion to adjourn on the floor is there a second how do you vote yes how do you vote yes thank you Sharon we're adjourned


Well, hello and welcome, everybody, to this OpenShiftCommons.gov SIG Talk. It's one of a series of briefings that we do every week, and this is the kickoff for the .gov special interest group. So we're really pleased today to have Jason Callaway, who's been working on the OpenShift Compliance Guide and has been working with a number of customers and deployments in the federal government sector on FISMA compliance, and he's going to share with us the work that they've done to create the Compliance Guide and open up a conversation with the rest of you about maybe contributing to that. So without any further ado, Jason, take it away. Awesome. Thank you very much. All right. So let's just dive in. You know, normally when I think about compliance, the first thing that comes to mind is driver's licenses and sitting in a DMV, because that is also sort of a form of a risk management framework, and it's a useful analogy because none of us like it, none of us really like going to the DMV, but at the same time, I don't think our lives get better by getting rid of driver's licenses and just letting anybody do it. So it's sort of an unpleasant thing, but a necessary thing. And it's a little bit more than that for those of us that work with the U.S. government because it's actually the law. There's this thing called FISMA that came in this E-government Act in 2002, so you can actually look that up and find it in the United States Code. And it has sort of a spaghetti chart of implications. So FISMA has been amended a bunch of times from the original Act that was passed in 2002. It identifies various federal agencies that are responsible for implementing and enforcing this stuff. NIST is really the main one that we typically think about, and they've published a number of different special publications that affect that, sorry about that. So apparently I'm not able to mute my phone, that's awesome. So we have the risk management framework itself that comes from NIST Special Publication 837. We've got template SSPs that you can use, that's fantastic. And then FIPS 199 itself describes how to actually implement that risk framework. The security controls that get implemented come from this monster document called 853, special publication 853, and that's got a total of about 1500 individual security controls. And then there are some other guides that you might have to comply with such as FIPS 140-2 that does a lot with which crypto algorithms you're able to use, and it has a certification process, and we can talk about how Red Hat technologies comply with that. The way that you typically automate these things is with an umbrella of technologies from NIST called SCAP for the Security Content Automation Protocol. We have an open source implementation of many of those standards that come from open SCAP. We have another project called the SCAP Security Guide that has a bunch of XCCDF profiles to implement things like the STIG, which is itself an interesting bit of dependencies there. So the SSG actually is upstream of the US government configuration baseline USGCB, which informs the STIG that is published by DISA, and that's a coordination effort with several different agencies there. If you're working in DOD or in the intelligence community, there are still separate authorities that you have to worry about, and then there's some terminology that's changing. We used to call it the certification and accreditation process. That document's been deprecated in favor of a new risk management framework. It's called ANA Now for Assessment and Authorization. So it's a big mess, and typically a barrier to being able to get on with doing the work that you want it to do. So normally in this process, you create a great big spreadsheet of all these different security controls. You down select that to the ones that apply to you because there are numerous non-technical controls in here. And NIST deliberately did not label controls as technical or non-technical because depending on your project, you may have a technical way of implementing that and you might not. So it's designed to be very flexible. But the implication of that is that it puts more work on the end user who's actually writing the system security plan and taking that body of evidence through the ANA process. Gosh, I apologize about the phone there. Okay, so moving on, we have published this OpenShift Compliance Guide that is sort of this is sort of a very new effort and it's not typically done. Normally and in fact, if you look at the FedRAMP document which is sort of around, good grief. Very sorry, hang on one moment, I'm doing a briefing, I'm going to go terribly sorry about that. So we've taken a lot of the work here that we've put into doing this ANA process several times and we've open sourced that. We want to be able to get some reuse out of this because we find that we've done this a number of times and we're constantly going through that same work. So while this is sometimes done in sort of a sensitive environment where the body of evidence itself may be classified or just sensitive, we've taken those things that we're able to share. We've open sourced it and we've put it out in sort of a framework that we think will be a little bit easier to scale and collaborate. We call that the OpenShift Compliance Guide. This is actually hosted off of GitHub, the visual interface here is done with something called Read the Docs which is a really cool tool that we can dive into a little bit more and sort of break down what we have in these different sections here. The reference architecture is really important and when you're going through the ANA process, one of the kind of primary things that you have to get through is just educating your creditors on what it is that you're trying to do and particularly with new technologies like containerization, that can be a challenge. We went through this whole thing once before with virtualization and there were many sort of learning curve moments there where previously but before that every single information system as an example was physical and had a barcode on it, an asset tag and could be tracked as an asset. So once virtualization became a thing and it wasn't possible to put a physical barcode on a virtual machine, that tripped up a lot of people in that older C&A process. So now with containers, again, there's more to learn about. So having a reference architecture and this CONOPS, this concept of operations, PreFab is going to help you get through that process more quickly. The SCTM, the security control traceability matrix itself is the core of this whole project that's actually a very large spreadsheet which is sort of our canonical source of truth because while you generate a body of evidence and a system security plan and it's all nicely formatted, every time I've done this, it really comes down to sitting with your creditors, having a spreadsheet up on a projector and going through the things that they care about line by line. So that's why we made that sort of the core of the project. That spreadsheet gets parsed and we procedurally generate what you see on the read the docs website. And that's handy because you can just send somebody a PDF of that if you want to sort of jumpstart that process. But the spreadsheet is what you're going to end up at anyway. In that spreadsheet, we identify who is responsible for implementing a particular control. So in some cases, it might be a physical access control, a non-technical control that we sometimes refer to as the guys with guns controls. So that's going to be your physical security officers that are being sure that only authorized people are actually able to get into the building where your information systems are hosted. Typically, that's not an open ship thing, that's somebody else. So there are different roles of people who implement these things. The customer responsibility matrix makes it very clear what an open shift consumer has to implement in their SSP. And then we've done a lot to automate this with Ansible and we're well down the road to being able to sort of have a turnkey, press button, get reference architecture deployment. We'll talk about that. We're not quite there yet and we really appreciate help from the community. So just to go over this reference architecture a bit. We did this based on Amazon web services because that's where we've done a number of these open shift three deployments now and it's what we knew. It doesn't need Amazon, this could work on any infrastructure. And because OpenShift runs on top of RHEL and uses Docker and Kubernetes, all it requires is RHEL. So that means we could be doing this on VMware, it could be on top of OpenStack, Azure now. So there's very many options. It's just that for this one, we happen to use Amazon as a reference architecture. We would like to generalize that but we didn't have the time to make it really general so we stuck with what we knew. So we have here a very conceptual diagram of all the different components that go into this. So this is something handy that you can give to your accrediting engineers to kind of review what that architecture looks like. And then we have a more kind of a more abstract view here of the different system types and how those interact. All of this is in the compliance guide, by the way, but I thought it might be a little bit easier to go through slides. So this one is a pretty important one.  It's done for you here down to the port level and identifying which system types require different ports and how that data flow works. We also have a conceptual diagram of how the build process goes for when you actually spin up an app. And this becomes really important when you're dealing with folks that might not be familiar with OpenShift or just straight up might not be familiar with how Docker and OpenContainer image format works. So being able to show them this and how you take application code from a Git repo and then that gets pulled into our source to image or S2I process, then that will create an app image and stick that into the integrated registry. This kind of helps break down that knowledge barrier to be able to get to this. Now when it comes to how you actually implement FISMA compliance, there are baseline controls around what we call the CIA triad and that doesn't mean typically what you think it means. It's not in this case referring to the central intelligence agency but rather three different types of areas of concern around confidentiality, integrity, and availability. Each one of those has a baseline low, moderate, and high setting. And we designed this guide to help you achieve the FISMA high deployment. Now as you might imagine, having high ratings for confidentiality, integrity, and availability is more difficult to achieve than simply a moderate setting. And one of the things that you have to worry about at high is encryption at rest and in transit of your storage. So this became sort of a more complicated thing than we thought it would be when we set out to do this work because one of the things that OpenShift offers you is persistent storage through the PV and persistent volume and persistent volume claim process within Kubernetes. So how do you scale that and how do you get encryption at rest and in transit there? And there were a number of ways that we could have hacked this and we ended up deciding on this architecture because it gave us the best balance of bang for your buck with your underlying compute resources, in this case Amazon EBS volumes, and then where we were actually doing the Lux encryption. And one more note here. We wanted to use Lux because it comes out of the box with REL. It's a free to use tool. Some government agencies have a preferred provider of storage encryption. So if you have some other thing that you've got to use, you could certainly sort of plug and play there and use something other than Lux. That's just what we chose here in this particular architecture. Before we go on to kind of digging more into the controls, do we have any questions in chat about the reference architecture? We've got one question from Sean Wells on the data flow side. Do you have anything that shows where the encryption is being used for node to node and internal to external communications yet? That's a great question. I don't think we have that documented, but that's something that we should capture. So this brings up an excellent point. When you're looking at this guide and if you find that it doesn't have something that you would find to be useful when you're going through your ANA process, let's just open an issue on GitHub. This is an open source project and we have the opportunity to collaborate here. So that's a great opportunity to open a GitHub issue so that we can get that into the guide. Or if you want to make it really easy, you could simply write that in yourself and issue a pull request. We'd love that even more. So the only other question so far is they were looking for labels for each of the slides. But what I was going to say is if you go to the OpenShift Compliance Guide, read the docs page that the URL is in there, you can find almost all of these images that he's using in that, I think for all of them, are in that guide at some point. And I'll try and cross-reference them when we post the video next week. Other than that, you're moderating right along. Do you have a URL for the GitHub repo for issue requests? Sure do. So if you use our tiny URL that we had back here earlier, OCPCG for OpenShift Container Platform Compliance Guide. In the upper right there, there's an edit on GitHub link. So that'll take you directly to the page for that particular section that you're looking at. And then anywhere from there, you can just click on the Issues tab to be brought to that. I'll just pop that. I have that link and I'll pop it in now. So if you want to go motor on a little bit more. Excellent. Continue. So given the guide as it stands today, this is the breakdown of controls and who's responsible for what. So of the total of about 1,500 controls in NIST 853, we find that about 660 of those are technical controls or at least controls that may be of interest to an accreditor who's going through your body of evidence.  So that's that might not even be of interest. But for other things like. Passwords on the BIOS for the underlying host system, that will fall into whatever I as you're using. So in this case, we're using Amazon EC2. That's something that they handle and they probably have their own SSP for that.  We inherit that control. So this is the breakdown. An open shift consumer or a tenant in this landlord tenant model, then would be responsible for tracking 73 controls, whereas if they were, say, running their own open stack and building their own applications in there, they'd be responsible for everything up to and including that I as layer. The security control section, we're missing some things. And we've got a couple of janky workarounds right now. Ultimately, they need to become RFEs and get upstreamed into open storage and make it into the enterprise-grade product. The way that we work around some of these things is sometimes, as I said, a little bit weird. One example would be the way that we do security banners. So there's no easy way in the OpenShift tool right now to add some kind of security banner saying like secret classification at the top of it. The way that we get around that is we just wrap the web console in a little bit of JavaScript that adds like a 10-pixel banner at the top, that has the proper color and the right stuff in it, and then we resize an iframe to actually hold all of the real web console. In this particular case, we have this already written and we're going through a downgrade process to be able to make that and classify and put that into the compliance guide itself. If sometimes that can take a while, depending upon how motivated our government sponsors are to actually get it done, we could just rewrite it. So this is an example of one place that we don't yet have what we need in the guide. We have some sections that still need some work and this would be one of them actually being able to add that security banner. Sean and I had a great conversation last night about a couple of these other requirements and one example would be like the notice and consent click-through that you typically have to use when you're in one of these environments. So that normally when you log into an environment, you have this say a DoD warning banner where you agree to monitoring and you promise that you're not going to use the thing, you hit OK to accept. In many cases, you're able to inherit that control from the workstation baseline for the agency where you sit. Many of them have workstations that that government agency manages. They have they have their own set of click-through. So we found that we're typically able to inherit that control. That's another thing that is not well documented in the guide yet and is something that we have to go through and make a little bit more explicit. So there's a number of places where we have the opportunity to collaborate here with the community and get that discussion rolling. The customer responsibility matrix, like I was saying earlier, is of interest to open shift consumers. And there's a couple of different sort of use cases for this guide. One would be where you are hosting your own open shift environment.  So in that case, the group going through that any process would be responsible for both the landlord and the tenant set of controls. If this is in a in a container as a service sort of context, where where you you're just consuming that service and someone else is managing it, then you'd be responsible for those tenant controls. So that's sort of the assumption that we made with this guide that in most cases it's going to be one group that's hosting it for many other customer organizations within that agency. And that's the bit from the customer responsibility matrix that you'd like to give out and make it easier for your your sort of meta customers there to be able to have a very clear picture of what it is that they need to do in order to become accredited when using when using this guide. And like one example of that then would be the control RA3, which is the risk assessment. You have to do that on a per sort of a per program basis. So this is this actually brings up an interesting frequently asked question, which is does this guide mean that open shift is accredited out of the box? And that's that's a no, you can never pre-accredit software. What we're trying to do with this is lower the barriers to entry to get to that accreditation and we're going to get better at that over time. But it shouldn't be thought of as I hand this guide in and that and that means that we're this product itself comes pre accredited somehow that's just not the way it works. Now, I mentioned before any questions on that much before we move on to the Ansible stuff. There was one question Sean tried, I think, answered it here. Jonathan was asking by inherit this control for click through, just to be clear, you mean that because users already have click through on the workstation used to access to open shift, you don't need to need it in the OCP console. Absolutely correct. Yeah. And then Jonathan's asking, any timeline or version target for official FISMA baseline? No, that's always a good question. Yeah, yeah, that we I'll get to that when we when we get to the end, I've got a couple other facts that we can get through. So with the Ansible stuff, we're trying to automate as much of this as possible and make it repeatable. And this further lowers those barriers to becoming accredited when you do this yourself. This is sort of just a temporary placeholder until we get this to a more permanent location. But on Ansible Galaxy, we have an org that is sort of a roll up of many of our standard roles that we've used to implement these things. Just a quick overview. Ansible is a sort of a Python and YAML based configuration management and automation framework. It's very, very easy to use. You just write these YAML playbooks that describe what it is that you're trying to do, although you could write your own Python based modules if you wanted to. And we'll look a little bit more at what some of these look like. But we've been using these to to make this a little bit easier, a little bit more repeatable and particularly to give to our our users who may not be super familiar with the tool so that they can implement it more quickly. And actually OpenShift itself, its deployment mechanism uses Ansible. So with Ansible itself, roles give you sort of a pluggable way of taking a set of playbooks and all of their associated variables and even libraries that they require and make it easy to plug those into the playbook that you're writing. So we've broken many of these things up into roles like the 853 role, for example, implements many of those controls at like a rel level that you have to get through in order to be compliant with all the controls that you see in this guide. That's just sort of a nice to have and it's non-official. The official way to scan for and we're working on the implementation side there that is with OpenSCAP and the SCAP Security Guide. We publish a lot of that stuff and Sean is very, very plugged into that. And I'm sure we'd be happy to talk in depth about any SCAP stuff for SCAP Security Guide stuff, which might even be an appropriate follow-up briefing for the next time we do this .gov stuff. So the 853 role is there. The link will be in the slides for when we send that out if you'd like to play with it. That's broken up in such a way that it's kind of easy for admins to understand what's going on and then make some changes. So this is an example of some of the default variables that are set in this role. And we deliberately made it sort of admin-centric as opposed to compliant-centric. So as an example, if you look at line 12 there with the shared library path, that's very obvious what it's talking about. It doesn't tie that back to some arcane control that then you've got to dig for to see what that means. So this makes it a little bit easier to achieve that accreditation to implement those controls. So that's part of how we've been doing this. Here's another example. We've broken the different tasks down into control family. So in the axis control one, you can see here an enable SC Linux control and then which play and then which controls there actually tie back to that. One of the nice things about this design is using the tags system. You can specify by CIA, low, moderate, or high what controls you actually want to implement. So at runtime you could say I want confidentiality, high, integrity, high, availability, moderate, and then it would tailor it to only apply those different controls. All of this goes into sort of a larger effort that we've been going through to create a way to make it really easy to reproduce fully disconnected deployments of OpenShift. So what does disconnected mean in this context? When you typically deploy OpenShift on a system that has connectivity to the internet, you've got a lot of resources that are available to you that you might not have in a fully air-gapped environment. You can register your system with the Red Hat content delivery network. You can pull your RPMs down simply by enabling those repos and running the various prerequisite commands and then the deployment ansible playbook. If you have to pull down any additional Docker images that you might not have locally, you can go out and get those from the Red Hat registry or from some other registry. Doing these things when you have no ability to hit the internet makes deployment very, very challenging. So the goal of this effort was to not just come up with a way to implement that reference architecture in the security con off, but also to make it easier to, for one thing, practice doing those disconnected deployments because you actually learn a lot just in going through it once in say like a private VPC like we're doing here in this project. And then you can take all of those deployment artifacts that you pull down into your bastion VPC there, tar those up, bring them across your air gap and have a much easier time successfully deploying that on your disconnected environment. So that's what we're doing there. If we were to describe the compliance guide and none of this is actually official, so but if we were to think of the compliance guide as sort of being at a beta degree of maturity, this OpenShift disconnected effort would still sort of be an alpha. There are a couple issues that we have not quite tracked down yet, just due to time constraint around the deployment, not completing particularly like with the HAProxy load balancer. So we have some opportunity for collaboration and improvement there, but in the long term, I think this is gonna be one of the easier ways to actually achieve those disconnected deployments. Oh, we've got a couple of typical questions that I wanna hit, but before we move on, any questions about the Ansible stuff? Well, Sean is saying that he really, really loves the disconnected install scripts and he's asking any plans to work with OpenShift product management to formally incorporate and add support for disconnected installs? Absolutely, yes. So the goal for all of these, so that segues nicely. So these are the four most common questions that I encounter when talking about this stuff. And is it official? And the answer is not yet. This is something that was born out of the public sector group within Red Hat. Sort of it came from the field with a lot of deployments that we've done. We're trying to sort of get it to a point where other people are gonna be able to understand it and then like we're doing now, we're sort of opening that up more to the community so that we can get it to a usable state and get that incorporated upstream. So our goal would be to get this compliance guide hosted off of the official docs.openshift.com and docs.redhat.com sites. But it's not official yet and there's a lot of work that we need to do to be able to get there. Nor is it complete. Like I was saying earlier, we're missing many different implementations such as the security banner. And we as a community sort of need to decide how we want to approach that. Do we wanna continue with that janky JavaScript window? Probably not. We probably wanna get RFBs open so that it's a parameterized value within the OpenShift tool itself where you can specify I wanna have a banner of this height and color with this content. And one thing to always bear in mind is no matter how official or accurate we can make this guide, it never ever makes OpenShift accredited air quote out of the box. You have to have a sponsor program. You have to have your own system security plan and in your full body of evidence that you put through that A&A process. It is a per program, per effort type thing that simply cannot be generalized at the product level. But what we can do is help you get through that more quickly and help you educate your accreditors so that they're more comfortable getting through that. And we wanted to do this in an open source way because we're a 100% open source company. If like we were saying earlier with the FedRAMP SSP template, it comes pre-populated with headers and footers that say company proprietary trade secret type stuff. And typically that's how this type of data is handled. A company might put some effort into making it easier to get through accreditation. But that then becomes some more secret sauce to entice you to use that product. That's just not how Red Hat rolls. We wanted to do this in a fully open source way. And I think everybody's gonna benefit from that. Any other questions? No, we might unmute Sean and let him talk a little bit too. He's adding some commentary here. You just find Sean in the list of people who go. Sean, if you unmute yourself, you should be able to talk. Oh yeah, I'm here. I don't know what I could add. Jason's doing really great work. On the accredited out of the box thing, one of the things we're trying to do with Red Hat marketing as well as within public sector is create kind of this government ready concept where using REL7 as the example, we ship government paperwork, like the accreditation paperwork. So all of the control mappings Jason's showed that spreadsheet thing, all of the implementation guidance and the idea is to start going through regulated baselines like the STIG, which is for DOD, BISMA, which is largely for civilian and actually ship government ready deployments or government ready reference architectures. And kind of what Jason's done is set us up for success to do that for OpenShift. All right. Jason, do you have any more slides tucked up your sleeve there? No, I do not. But thank you very much for the opportunity to share this. I'm really looking forward to more community involvement here. We've already had a couple folks from some of our agencies provide a little bit here and there. But when we approach this in the open source way, I think it's gonna make this easier for everybody. Yeah. Well, I also liked your suggestion that maybe having a follow-up on OpenScap would be a good thing as well. Plus, once we get this up and out onto the blog site and other people who wanna put comments on it, if you wanna post another one to review the issues list and have a conversation about that as part of the OpenShift Commons DOV SIG, I'd be happy to do that to help drive through this in that shape and get some community feedback on it. So if anyone's on this call that it has further things that they'd like to see in this guide, please do pull an issue or contribute something, make a pull request and create the content and we'll try and get that out there into this guide as well and give you a place to have conversations about it here in the GOV SIG. I'm looking to see if there's any more questions if you enter them into the chat. We hopefully Jonathan's saying that hopefully he can contribute to it in the future. We hope you all will too. So Jason, it doesn't look like there's any more questions. Sean, thank you very much for doing this session. It's hopefully this work will get incorporated into the product management workflow and get out there in a relatively short time. So thanks again, Jason and I look forward to having you guys on again to do OpenScap. Thanks Diane. Take care guys.


Okay everybody for us here up in 2022 flawless football hobby 1 box number 29 left-side serial numbers That's random and rip. Good luck everybody. Thanks for joining Go with 10 times. Yeah, I'm sure that'll happen Mike better chance to meet by and you guys 10 on the random here on each Names first one two three four five six seven eight Eight nine and ten Michael s down to Gregory M and the numbers here one two three four five six seven eight nine and ten ten down to twelve Michael s 10 Edward E 9 Kevin H 16 Michael D 6 and 17 Rob C 21 Terry F 25 Michael D 4 JT 23 Sean M 18 Chad P 2 Jonathan L 1 Ray G 19 John D 11 Alexandros 22 Kuniaki 13 Peter M 7 Barry G 3 D W 5 Rob F 14 Scott F 8 Gregory M 20 terpy with 15 Michael D 24 Gregory M 12 Maybe Sean's possible because you're in Vegas. Come on now. Come on now Yeah, you know, I'm gonna go see the Patriots and Sir fool this year Well, I think Tom Brady will be there probably that's about it Tom Brady will be there Like he's always They always do some ceremony or something Definitely a South Florida guy now I'm pretty sure that I think just a move to Miami. Yeah, I think he's down there to make sense Yeah, let's go Greg. Let's go pretty mind your manager Greg's here. Yeah What All right triple patch Rams patch here 19 of 25 Stafford cup and Donald call it hits as you go along as well 19 is Ray Ray with the triple ram This patch card there Rams legends What up strive strive Fourth quarter to you Andre Jordan minutes. What? Yeah, there he is. I don't know what he's doing out there Quentin Portasota four of five flawless performances Four spot is Michael D Strive came into the shop today Dude drives here all the time man. This was here as much as you are hey now Dual patch rookie auto Trayvon Walker 20 of 25 for the Jaguars 20 spot Gregory M Let's go Greg Trayvon Walker dual patch rookie auto got a TD Terrell Davis autograph 11 of 15 now a Couple of Denver running backs here 11 spot John D John go John nice TD Rookie frame signature is gonna be Aiden Hutchinson 10 of 15 10 spot Michael S sweet Aiden Rookie frame signatures Kenneth Walker the third now 23 of 25 the 23 spot is JT Let's go JT good inner box here and then do not see this auto much much That is a Patriots Mike Haynes Hall of Fame autograph one of five One spot Jonathan L. Mike Haynes. He's the Patriots Hall of Fame. I don't think he's in the oh, he's in the purple Hall of Fame. They're right You should know better than any dolphin ever Patriots auto You thumbs down that Spence Thumb up Old jacket green jacket. Nobody gives up That's a happy Gilmore line by the way. I'm not actually I don't know I'm not actually Meaning that Ruby six of 20 Mike Evans for the for the bucks a goat the other but a six-spot is Michael D Color match Patrick my home is dual patch card 13 of 15 Patty Kuniaki with 13 Kuniaki game war and let's go game war in my homes Cannons I want some fire and Yeah, this is fire. You all want to see some fire. All right. First of all, whoa, there it is. Whoa big big card diamond guarantee Nike swoosh Sam howl One of two symbolic rookie patch autograph fire. What a hit for Jonathan L Serial number monster right there Gigantic Swoosh Sam how that's disgusting That'll do that'll do we're on to the next one everybody on the next one