Quý vị, kính thư các vị đại biểu. Xin chào mừng quý vị tới buổi lệ bế mạc. Lê Cát Trông Lê, bạn có thể chào mừng tôi đến đây không? Xin chào. Tôi hiểu tất cả những tên dụng là tên dụng rất quan trọng khi đến với music ở Việt Nam. Tên dụng của bạn sử dụng tên dụng tên dụng tên dụng tên dụng tên dụng tên dụng tên dụng tên. Bạn có thể nói mọi chuyện Nó là một cơ hội để đi bên trong, và một cơ hội bình tĩnh. Cái cơ hội là về mơ, và mơ hội mà tất cả mọi người có. Cái cơ hội là một cơ hội của một cơ hội bình tĩnh. Cái cơ hội mà tất cả mọi người không thể nói. Wow, chúng ta đang tìm ra. Thank you. Còn chân chữ chỉ hơi cho nát tranh văn, vư tình là điên, nè mô mê nát tranh văn, sông sâu trôi ước trôi. Còn chân chữ chỉ không trăng dậy. Thank you very much. So now it's to invite the co-chairs of the meeting to join me here on stage. It has been substantial summit on ASEAN, the 27th one. I think ASEAN also has grown even more in importance during these 27 years. Let me start with Mr. Kevin Snyder, who is the global head of McKinsey. I know you know the region really well. You've been living in Hong Kong, maybe that also shows how past the world is changing, that the global head of McKinsey is now based in Hong Kong and not in London or in New York. So Kevin, what is your main takeaway from this ASEAN summit? It's been a very busy 48 hours, whatever it is, it's hard to believe it's over. First of all, the economic optimism that remains for all the talk of trade conflict, for all the many challenges one can hypothesize, strengthening dollars, etc. I do still sense from the conversations I've had and also just observing where we are that the underlying fundamentals of this part of the world remain solid. And therefore, while there may be turbulence in the near term, we should expect and can believe in a very positive future for ASEAN and beyond. And related to that, and I think this does tie to the theme around the fourth industrial revolution, the requirements to evolve the model that ASEAN has had which has been successful to one that recognizes the need to reinvent the labour force, the need to engage in the activities that will lead to digital productivity and the investment and infrastructure that that requires, that would be the other part of the conversation. And if I had one last takeaway and I'll keep it short, the value of dialogue, the conversations that one's had over the last 48 hours, the kind of bringing together of many different voices is truly unique and I think has reminded me of how valuable it is to spend time on these issues but I leave with a strong sense of optimism. Thank you. I share with you this feeling of optimism but when you then turn on your TV, when you come to your hotel room in the evening and watch the world news, there is quite mixed news. Of course, U.S. economy is growing very strongly this year. The global growth will be still 3.9%. But for ASEAN overall, are you also optimistic in the coming years? Is also ASEAN well prepared if the global growth is going down? We will not see a repetition of what we saw in the 90s. Well, I think the situation today is a bit different from the 90s. I mean, even on an economic basis, we have floating exchange rates, not fixed exchange rates. We have a situation where the geographic exposure of many of the countries is different than it was back in 97. That said, look, there could be near-term gyrations, near-term turbulence, but I think the ultimate way of looking at this is the fundamentals remain 650 million people, a market that is rapidly leading to consumption as opposed to just a quantitative market where you've actually got consuming middle class coming in and spending, and ultimately also the trade flows. The trade flows are changing. Intra ASEAN trade, whilst it's been stuck at 20, 22, 24, you believe, I do still sense that if we are going to see trade barriers put up in some parts of the world, well, that just underscores the need for and the importance of greater trade within this part of the world. So I remain confident in the long term. That's not to say we could have some fallout in the short term, but I think you look at these economies, they're well placed in the longer term. The interest from other countries in investing in ASEAN is growing fast. When I looked at the FDI figures, I was a little bit surprised. Japan is still the largest investor in ASEAN, China number two. Why is there this big interest in investing in ASEAN? And do you think what we are now seeing with some disturbances related to emerging markets like Turkey, South Africa, and Argentina, are you concerned that this can also have negative impact on ASEAN or is ASEAN, as you already touched on, more resilient? Well, ASEAN is different. I think the risk of contagion, which is what people talk about, often leads to confusion around the underlying fundamentals of different parts of the world. Argentina has huge exposure to dollar, loans, it doubled its exposure. If you look at this part of the world and you look at across the geographies, you will find that external debt and dollar-denominated external debt is a far more modest number than it is in the parts of the world where contagion becomes even more risky. But perception can be reality and I think it is very important to disentangle the commentary and again focus in on the underlying fundamentals of these economies. We heard from Shreemiliyani that there are things that, for example, Indonesia needs to do to reduce its current account deficit. That remains important. But at the same time, Indonesia is one of the greatest consumer markets that the world will see. Will see, not may see. And so I think when you put all that together, again, there is the risk and the stock markets will gyrate. There's no question, you'll see opportunistic speculation and all that goes with it. But the fundamentals, I think they remain very attractive. And I think we're all impressed also with the growth and robustness of the Vietnamese economy. I think I was, when we prepared for this conversation, I even heard that McKinsey has 100 people already in Ho Chi Minh. That means that you believe in this country too. We very much believe. We have two offices, one in Ho Chi Minh and one here in Hanoi and I think our commitment to Vietnam is consistent with many foreign companies who are looking at Vietnam and it's relatively attractive from an FDI base. The manufacturing base here is very substantial. It's an export economy. I think the challenge for Vietnam is to use that base to start creating more consumption, more development amongst its own people here at home. But the fundamentals of Vietnam are as good as any you're going to see in this part of the world and the growth rates show that. So we are very optimistic of Vietnam. I see that Deputy Prime Minister on the first row is nodding. We'll come back to you Deputy Prime Minister. We now turn to Anna Biggett Albregson. She is the CEO of Plan International. It's an important developing organization and I think you are even doing work here in Vietnam and of course all over the world, especially known for incredible work among girls and women. So we are very happy to have you as a co-chair of course, but what are your main takeaways Anna Biggett from this today, sir? Thanks Berger and really thanks to the forum for also including us and civic organizations in the preparation and leadership of the meetings. My main takeaway is that there are so many agendas that government, private sector, civil society have in common. So many challenges that we are trying to overcome together. Whether it's social inclusion in the fourth industrial revolution making sure that everybody can take part in the digital economy or addressing new risks, reputational risks of organization around sexual harassment in the workplace or the risk that we all face with fake news and mainstream media that is being undermined by other sources. And these have been topics that I've been part of discussing here. And I see a real appetite for collaboration across sectors which I really think is the essence of the forum. And Anna Biggett you have a long career in the field of development also with the UN and UNDP. At the opening we heard a message from the secretary general that was read by one of the assistant secretary generals where the S3 reminded us about the tremendous development path this country has been through. Just a couple of decades 50% of the population in this country lived in extreme poverty. Today it is 3%. Is there any lessons learned from this country that can be applicable to other countries because there were a lot of other countries also having 50% of the people living in extreme poverty 20 years ago and there is still 50% there. You know I think what sets both Vietnam and also ASEAN apart from the rest of the world is also it's phenomenal investment in education. It's not just recent it's true and deep in the culture of the region to invest in education and that has obviously been one of the fundamentals to help the region spur forward so that is certainly a message that we need to carry across. I do think that what we are seeing unfortunately also in ASEAN is that as that education has become more and more inclusive as girls are now in many countries superseding boys in attaining high levels of education the economies are still not taking full advantage of that really fantastic resource of well educated young women in their workforce we still have fairly low workforce participation of women and our colleagues from McKinsey keeps reminding us of how much waste that is the GDPs of these economies could grow so much more by including women in the workforce so I think there's a lot to learn from Vietnam and from the region for the rest of the world in terms of really getting those high levels of equal opportunities in education now we need to create equal opportunities in the workforce and for entrepreneurs. So there is a huge potential of then having more women entering the workforce so Thank you I'll then turn to Nasir Rasak he's the chairman of the CIMB group Holdings Malaysia Nasir has worked with the World Economic Forum on the original base but also on the Fort Industrial Revolution through many years the team here has been related to the four IR and I guess that the success in implementing the right policies to enhance your competitiveness related to the four IR is also is going to be quite crucial in defining also the standards of living in the future globally and also for ASEAN Thank you I reflect back on Kuala Lumpur 2016 the ASEAN the WF ASEAN then and I recall leaving that event somewhat despondent about the momentum of economic integration and also any recognition of a new industrial revolution forthcoming and yet today or this year when I listen to all the ASEAN leaders themselves every single one of them acknowledge the threat of the fourth industrial revolution and we had an ASEAN secretary general who reaffirmed over and over again that he wants the fourth industrial revolution to be at the forefront of his agenda so over the past couple of years I think yes the environment has changed in a sense that that's probably a recognition that we need each other more because of the the more insular US and the more hostile trade environment but there has been a lot of work done by WF not least the report we did on ASEAN and the fourth industrial revolution and the very clear recommendations that were made about what needs to change and I know that as a result of that the ASEAN secretary had commissioned a study on the readiness of each country of ASEAN so I think you know since you are president of WF I'd like to congratulate WF because I think WF has made a difference to ASEAN ASEAN does recognize this 4.0 challenge clearly and I'm optimistic about what the ASEAN secretary will do now going forward because this morning the secretary general effectively acknowledged the power of this model called the platform organization which was a strong recommendation in our report so he's thinking of transforming the ASEAN secretary approach to regional integration using this recommended model which in effect means greater engagement with business to implement the changes needed so overall I think hats off to WF and feeling very optimistic that ASEAN is going to take the bull by the horn thank you for those kind words we are keeping our focus on the 4IR as you know the World Economic Forum has established a center for the 4IR in San Francisco and have no sister centers and affiliated centers all over the world I'm just reflecting on the policies that are important to make sure that the country is ready for the 4IR if you were going to give like 5 points on what you think are the most important policies to implement what would they be I guess you would start maybe with education I'm going to sound like a broken record I've been saying this for 2 days very consistent but yeah obviously education and within the region free movement of talent skill talent free movement of data free movement of capital education and of course to really look at the side effects and some of the issues and champions particularly some of the side effects on gender equality etc those are probably the 5 I will put out there Kevin you give advice and counsel on these issues what would be your 5 main topics for being really ready for the 4IR maybe the capital market venture capital would be part of it I think access to capital becomes very important because I think there is investment that is needed and remember there is infrastructure investment that is needed too some of that is in place but there is a lot more to be done the variation in bandwidth and speeds across ASEAN is profound 25 megabits in some places per second down to 5 in others so the infrastructure investment infrastructure is very important but I actually would echo what Nazir said education education and education and remember it is education of not just the younger people coming into the workplace for the first time but what are we going to do with the 40 somethings who have grown up and work in a particular skill that no longer is required because it is being automated or changed and improved and that group of people I worry about getting left behind and I think it is very important that we have an ability to re-skill not just to provide skills for those entering the workforce so I would add that to the education conversation Minister Nhi Man Hung you just took on this ministerial post as minister of information and communication and before that you were successful CEO for decades in the telecommunication business so you have the right background also for this important ministerial position listening to the two last days listening to your to the other co-chairs there how ready is Vietnam for the 4IR yes and after a couple of years as you as minister I guess you will be even more ready should be ready should be okay so after the 3 days very intensive discussion and the meeting I would share some of my thoughts or take away as you said the first one is about small and smarter government every time when a new industrial revolution comes new technology happen the businesses and the society can do more can do more of the government's work so that the government can become smaller and is easier for a smaller government to become smart and faster for change is my first the thought my second thought is about the so-called soft skin for the fourth industrial revolution in the past the technology only improving our life our management we enjoy technology and we didn't change much but now the fourth industrial revolution coming and the new technology change the way we live and change the way we manage we govern so we have to change not only enjoy and change our mindset the technology can change very fast but the people the government cannot change so fast and this will be our biggest challenge so what we do I think that the we have to train people so that they can adapt to change not only technology training education but more about soft skin ready to change or lead the change so I think that the fourth industrial revolution is more about mindset revolution is my thought Thank you change not only enjoy but we also have to change our mindset you were saying minister but listening to ASEAN leaders ministers and head of states talking about the 4IR I feel there is more like optimism and see the 4IR as an opportunity than as a threat why is that why because if you go to some summits and seminars in Europe you feel sometimes a little bit depressed when you listen to 4IR kills jobs and all this but you know the jury is still out all the three other industrial revolution created more jobs and higher life quality for the world I don't think we should take for granted quite the contrary that this fourth industrial revolution will not create more jobs and opportunities so why is the mindset different here if I'm right in ASEAN than many other places I think that's the every new revolution industry and revolution is more opportunity it just depends on how we look at this new technology and if we look back history every revolution made our society made our life better no unemployment even less unemployment is a historical experience so we can believe that this time may be better thank you last comment from the three other cultures on this Kevin optimist or I'm a long term optimist I think the one of the things I looked at recently was some research that showed if you look at the 71 emerging markets that have a sensible amount of scale and you look at their performance over a long period of time you very quickly find that there are 18 outperformed let's say the United States in terms of growth 8 of those markets are here in ASEAN and when you think about what that means with all the challenges that they've been we talked about 97 various economic upheavals social upheavals this part of the world has kept on delivering and that's why I'm an optimist it's lifted an enormous number of people out of poverty to bring women into the workforce alleviate some of the child labour and other issues but this part of the world is destined to grow so I remain very strongly in the optimist camp Anna Begitta is there optimistic NGOs too? Well personally I'm an optimist by nature and hopefully that's also embedding itself at least in my own organisation I think there's no doubt that there's tremendous opportunity also in this industrial revolution what I would hope that we can do is take some lessons from the other revolutions because there there were some very very very significant losers also that got left out of society for in the early parts actually for 10s, 20s, 30s of years before they sort of found their new way we can learn from that and make sure that that social inclusion that's needed and that bringing everybody along is a lot faster and we need public policy to ensure that we get that inclusion with us. No sir? Definitely glass half full I think there will be challenges but I think we will rise to those challenges over 50 years ASEAN has always surprised on the positive side I think that certainly the 4IR brings a lot of benefits and we should focus on the benefits first before we think of the externalities and the negatives we have a Prime Minister today who's 93 maybe with the 4IR we can have a Prime Minister who's 100 plus Thank you Thank you Let's give the coaches a big applause Thank you so much for being such thought leaders and being with us these two days we really appreciate it and also thank you to all our distinguished participants and partners and members you are the most important ones and I hope you have really enjoyed and come out of these two days more insightful and more inspired to contribute not only when it comes to the 4IR but also to growth, inclusive growth and sustainability This 27th Siam with the World Economic Forum is coming to a close but as you know many of you that have also been in charge of this kind of summits do know that there is a lot of work behind it I would like firstly to thank the government of Vietnam Deputy Prime Minister Prime Minister and all the Vice Ministers and Assistant Ministers that we have worked with during the last year the collaboration has been very good close and it has been dealing with a very professional government so thank you so much for the collaboration I would also like to use this opportunity to thank my colleagues at the World Economic Forum they have worked and I really mean it 24-7 the last week I would almost say weeks but that's maybe not totally true maybe 20 out of 24 hours the last weeks and the leader of our Asia Pacific team at the World Economic Forum Justin Wood many of you already know Justin can you stand up and we will give you Justin has been sending me emails at the strangest hours the last weeks and the team has been amazing also thank you to all the supporting teams publicist life and others that have been supporting us and we are privileged that the Deputy Prime Minister of Vietnam his Excellency Trong Hoa Bin will do the closing here at the summit so Excellency Deputy Prime Minister the floor is yours and thank you to the government of Vietnam again from all of us ladies and gentlemen dear friends Mr. Klaus Schwab co-founder and managing director executive director of the World Economic Forum due to his busy schedule he said goodbye to me allow me now to just say a few words during the closing ceremony of our World Economic Forum on ASEAN and following two days of working with nearly 60 sessions or substantive discussion our World Economic Forum on ASEAN in 2018 has successfully concluded with the theme ASEAN 4.0 entrepreneurship and the fourth industrial revolution our WEF ASEAN meeting has truly been a meeting of our people to exchange ideas on many of the important issues for the development of countries in the context of the fourth industrial revolution and within this there are many new perceptions experience and ideas, policies encouraging entrepreneurship and innovation of businesses and people our co-chair have also summed up very succinctly the ideas of our discussion allow me to just review some of them one is that only innovation with multi approach multi vision approach can help businesses launch to the forefront that is why the government and people of ASEAN countries need to continue to foster greater momentum for innovation for new ideas to flower and bloom and to create new momentum of growth in a world that is constantly in flux as a result of new technologies and our entertainment and the song we heard by Ms. Le Ca Chau Ly that you've just heard is proof of the potential of innovation and integration of Vietnamese youth as well as other ASEAN countries the Vietnamese government is ready and striving to create a enabling environment and encouraging businesses and people to strongly especially our young people to innovate and build on their entrepreneurship and dynamism of the whole whole economy and whole country and second the digital world and hyper connectivity is allowing for people to engage in greater innovation and gain access to new technologies new knowledge and new markets and building an open and smart education system is the key and platform to promote innovation to ensure that all can enjoy the benefits of innovation of development I applaud the conference for proposing and put forth new initiatives and ideas for people especially our youth in terms of skills and digital skills and to be able to take ownership of these skills and to meet the demands of the future of jobs this is also the chance for countries and businesses to invest in future education in ASEAN countries and three the changing world is posing a lot of new challenges for ASEAN countries realizing its vision of a community by 2025 and by becoming resilient ASEAN is opening its door to cooperation with partners in the region and over the world and the world economic forum is the cradle of many new ideas that is strategic and at a global level we look forward to your cooperation in the future and hope that this world economic forum that we are in will allow us to cooperate with each other even closer and come up with more substantive and concrete ideas at our meeting today into specific and concrete plans in the future ladies and gentlemen and through our meeting this time Vietnam hopes to work with the forum to promote dialogue and strengthen open partnership for a peaceful and stable ASEAN that shall grow prosperous our world economic forum for 2018 is also an excellent opportunity for you to experience the history culture and vitality of the land and people of Vietnam ours is a peaceful country of renowned sites of long beaches and white sand of majestic caves and unique cuisine that is also a trusted partner a dynamic economy and an attractive investment destination this is the place where many multinational corporations who are members of the forum have chosen to be a strategic production center linked with their regional and global supply chains we would like to cordially invite you to attend the Vietnam business summit under the theme of connectivity and innovation to be held right after our session here to discuss these open opportunities to invest and do business in Vietnam on behalf of the Vietnamese government I would like to express my sincere gratitude to Professor Schwab and the World Economic Forum for your treasured support and effective cooperation throughout the preparation and organization of the World Economic Forum on ASEAN my gratitude also goes to everyone who have participated in and contributed to the success of our forum Thank you for your attention


This is Think Tech Hawaii, Community Matters here. Hey, Alaha, and welcome to the Think Tech Hawaii studio. This is Andrew, the security guy, for another episode of Security Matters Hawaii. And today we're going to be talking about enterprise security risk management with one of North America's foremost experts, Jeff Slotnick. He's not in the studio, but he is with us remotely.  Jeff, welcome, and thanks for being on the program. I appreciate you taking some time out to share some of your wisdom with us today. I really appreciate it, Andrew. Thanks for the opportunity from the Wilds of Western Washington. Ah, the Wilds of Western. So in the Wilds of Western Washington, and I know you kind of work across the country, probably the globe these days, I like to get a feel for my guests, especially those with the amount of experience you've had. I know you're your prior service. Thank you for your service, sir. What's keeping you up these days from a security perspective? Well, you know, it really is very simple. I mean, there's a lot of things going on in the world of security, especially, you know, we start looking at things like school shootings, workplace violence, some of the cyber stuff that's going on that you're very familiar with. But you know, when it gets down to the end of the day, when you start distilling all this stuff down to its core root analysis, what you find is a lot of it is related to physical security and it's preventable.  And then, you know, of course, the other three legs of the stool detection delay and response. You know, so many of our organizations don't have the plans and policies. If they do have the plans and policies, then they're not training them and they're not training their personnel on the equipment. And so many of the organizations I go into have beautiful integrated physical security systems and they're using them to, you know, one-twentieth of their capacity and due to a lack of training. So what keeps me up at night is the fact that a lot of these things that have occurred recently are preventable. And we have the tools in place or the people in place. We've got part of the solution there and we're not using the rest of it or we don't have enough of the solution set there, which probably brings us to enterprise security risk management. I know this is a holistic concept that you and a few of other practitioners in North America really take this type of perspective to an organization. So walk me, walk us through, walk our audience a little bit through the sort of where ESRM kind of came from and then what does it look like today in its modern interpretation? You know, it's because I don't think it lives just in the enterprise, right? I mean, small and medium businesses can take advantage of these same fundamental practices. Right. Well, let's talk about that for a brief minute here. You know, when we're talking about ESRM, we're talking about creating an iterative process to manage security risks across all aspects of the enterprise. So what does that mean? That means we have to identify risk. We have to be people that align the strategy of the corporation with the strategy of the security department. We have to have a good understanding of business and ESRM is really an ASIS International Initiative to bring business process to security management and elevate security management in the C-suite and in the eyes of the rest of the corporate professionals. Yeah, so when we talk about the enterprise, you're not limited because I hear physical security management, right? But when we talk about the enterprise, you're also looking at the operational capacities. Maybe if it's a manufacturing facility, like what if the air conditioning goes out, for example? Can they function without air and then could someone attack the air conditioning to shut that building down? Or how deep do you delve into the business processes like out on the floor of a facility? Well, let's explore that for a minute. When we talk about business process, what you'll find when you start looking at the security function, you'll find that it has impact on investigations, human resources, operations, environmental health and safety, all cross into the realm of security. Now, sometimes security may have a lead role and in other times, security may have a supporting role. But in all cases, we have a role. And a lot of times that role is not appreciated by other folks within the enterprise and it's our job to educate them. And ESRM as a concept is one way of creating that appreciation and educating our peers in the business stream towards what value the security program brings to the table and how we can support the overall strategy of the business which at the end of the day is making a profit and staying in business. Yeah, very true. How long ago do you think we finally got a seat at the table? Are we still underrepresented in a lot of the organizations that you see? Well, you know, we've made great progress over the last 10 years. The advent of the Chief Security Officer, the CSO, and creating the CSO standard which is in its second iteration now and coming up for review again and defining the role of the Chief Security Officer within the corporate structure has gone a long way in creating that initial presence. But now we're not looking at just the Chief Security Officer. What we're looking at now is the entire security program and how the security program adds value to the enterprise and helps the enterprise to be successful. Yeah, it seems to me like in the past we've always had, or maybe even today somewhat, CSO was just a hat that someone got to put on briefly or for some number of hours a week or perhaps only when they went to brief the board of directors or the C-suite. Is that your experience or are you starting to see that as more of a full-time role? And if so, is that also occurring outside of the enterprise? Well, I do see that a lot. Almost every business I work with today has a Chief Security Officer and somebody in that position. Now, the title may change. It may be Public Safety Director or it may be Senior Director of Security or Director of Enterprise Security but the duties and functions all relate back to a CSO. And so even, do you think there's benefit for the smaller businesses who have to have someone in that role in a limited capacity maybe because they're wearing other hats inside the organization? Can they learn from the practices of a CSO and hopefully help educate their small businesses in their value? Absolutely, and let's talk about that for a minute. I've got 40 or 50 clients that engage us to provide those services for their organizations. So in a small to medium business or some of your larger medium businesses or smaller large businesses they may not have an FTE security person. So that is a service that they can outsource which I think is a great niche for us because we work very closely with a lot of companies to provide that role and provide that advice that a CSO would provide if they had one full time. That's awesome. I didn't know that you did that. I'm learning something here as well while we're talking. So that's awesome. So how do you engage a company then? They call you and say, we're a mess, we need help. What's that initial engagement as to be a four hire or a contracted CSO? Wow, you don't know anything about them. How do you start? Well, generally it starts, unfortunately, with something adverse happens and they reach out trying to get assistance. And then of course, as we're offering that assistance we're helping them through their immediate strategic issue then we can start looking at other things. And generally that starts with a good baseline risk threat and vulnerability assessment. Of course, this applies to any business of any size, should be looking at their risk and what risks can impact the organization and what the consequences of those risks are. Yeah, it's interesting. I want to talk about your particular methodology in our second half. But I feel your pain on that reactive thing where we get a lot of calls from companies who something occurred and of course we all in our industry know wish that they had planned for it and maybe prevented it in the first place. But is that getting better? Or do you think is it, I guess, the appetite for risk in the small business, it's typically an owner and he knows what he's doing with his business and he just doesn't take time to consider stuff really getting sideways on him and then when it does, you know, he reaches out. Is that still the norm or are you seeing people more prepared or just getting caught off guard by something that they really didn't prepare for? You know, I think the Department of Homeland Security organizations like ASIS International and others have done a lot. I mean, we've got the, now we've got the whole security cares program that has been taking off at GSX for the last couple of years where there's free education for small to medium-sized businesses and schools and things like that. So I think the resources are there. What I do feel is that a lot of businesses don't take the time to avail themselves of those resources. I mean, even in cybersecurity, look at NIST. NIST came out last year with the NIST Small Business Standard, you know, and you look at that and that's a great document and really has application in a lot of industries, you know, beyond small business. But how many small businesses really have looked at cyber hygiene and understand the impacts of that on their enterprise? You know, sometimes it takes an event to educate people. What we try to do is, you know, through presentations like this and other public forums, we try real hard to educate people to those risks and get them to consider them before they become an issue and put the plans, policies, procedures and training in place so that if it does happen, even if it's a small business, they have a path to walk down. Yeah, I kind of wonder if... Do you have any sense of... Well, I'll say this, I see a lot of companies that make plans but they really don't have the policies supporting the plan first. Do you see that very often? Well, what I see a lot is what I call the dusty blue binder. You know, a company will invest either in-house or contract out-of-house to create a specific plan for their organization.  The people that have roles and positions of responsibility in the plan have moved on, promoted out, retired, you know, in any number of things so that essentially when the incident occurs, even though they've got a plan, the plan is ineffective because it has not been trained, practiced or staffed properly. There's been a lot of those binders and they're all dated like 2004. I tell you what, Jeff, let's take a short break and when we come back I want to talk about Cetricon methodology and the stuff that you've developed over there specifically. We're going to pay some bills and we'll be back in one minute with Jeff Slotnik. This is Think Tech Hawaii, raising public awareness. Truth is I've been impressed. I haven't been asked such intelligent questions in a long time, thanks. If you're not in control of how you see yourself, then who is? Live above the influence. Hey, baby, that's you. I want to know. Will you watch my show? I hope you do. It's on Tuesdays at one o'clock and it's out of the comfort zone and I'll be your host, R.E.B. Kelly. See you there. Hey, Aloha. Welcome back to the Think Tech Hawaii Studios and this episode of Security Matters Hawaii. Jeff Slotnik is educating us on enterprise security risk management today from the Northern U.S. up there in Washington. Jeff, thanks, and welcome back, sir. I wanted to get into Cetricon. You've built an amazing tool there and I know you've kind of launched it. You've been working on it for a while, but sort of relaunched Cetricon and it's really exciting, I think, for a lot of business owners to understand that they can come and get some value out of a tool like this that you've built, you know, I'm not going to give away your age, but the years of experience that you've packed into this. So tell us about the, as much as you want to get into the history of Cetricon where it came from and then what you're doing with it today, kind of walk us through the tool. Well, interestingly enough, Cetricon is a conjunction of security training and consulting and a lot of people aren't aware of that. But, you know, I know we're limited on time and a lot about our businesses is publicly available, but we have a passion for security. You know, my background, I come out of an army engineering background which was really amazing and kind of moved into physical security with a couple of contracts on active duty where we were supervising the installation of physical security systems and more or less being in the right place at the right time, which was a lot of anti-terrorism or the beginning of anti-terrorism and septet in army physical security in the 1980s. But, you know, I came into the industry and I came into the industry my education is in business management. So I, you know, I started dealing with business management and engineering principles and project management and that's what I came into our industry with. So it gave me a very, very unique perspective on the process of security. You know, how we go about doing the things that we do. And on the other side of this, I started growing up with technology. My first technology, my first home computer was a Commodore 64. Interestingly enough, I was at a meeting last week and one of the young men sitting next to me asked me what a five-and-a-half inch floppy disk was and I had a detail to him what a five-and-a-half inch floppy disk was. Talk about feeling old. But anyway, you know, so I've grown up with technology. I've grown up through DOS and Windows and Microsoft and, you know, and computers that are just amazingly fast and look at the technology we have today and the platform that we're speaking on. And in 2003, I started looking at how we could apply this to a very, very old problem. I mean, you look at risk assessment and you look at a lot of the professionals that are doing risk assessment today and it really hasn't changed much in the last 20 years.  Now the report, instead of being handwritten, may now be done on a word processor and maybe utilizing Microsoft Word and PowerPoint for your presentation and in some cases, people have inserted Excel. But the data that's collected from a risk assessment is contained within that report. So you'll see a report. It's 250 pages long and the information is not readily digestible. So you turn around and you give it to the C-suite or you give it to another security professional. What do they do? They open up the report. They read the page and a half executive summary at the front and then they flip to the back to see what it's going to cost them. They look at all the mitigations that have been recommended and what those mitigations are. All that good data that's in the middle is not accounted for. All that time that was invested by the risk assessor in the process. You've done a few of these, huh? I've been doing risk assessments, literally hundreds of them over the years. Tell our artists a little bit about that. I don't know if they understand the typical, the military really figured this out long ago about that delay time it takes to stop that person from getting to the asset that you're trying to prevent them from. Give us a minute or two on that as quick as you can. Well, all physical security systems are measured by three definable terms, which are detection, delay, and response. Ideally, we want a system that detects our adversary as early as possible and delays them along the course of their path to their objective long enough for a response force to get in there and neutralize them and stop them from proceeding and breaching the facility or stealing a document or creating a vulnerability. So that's the core of physical security. Part of a risk assessment evaluates the physical security systems and evaluates them based on those three things. So we look at the threat. Who's the adversary? And now the adversary can be a criminal insider, active assailant, criminal insider theft, a terrorist, but it doesn't have to be just that because we approach things from an all hazards approach. So you may have stored chemicals on property. And those stored chemicals, if you have a 5,000 gallon leak of a hazardous chemical, it really doesn't make a difference how it was precipitated. At the end of the day, you've got a 5,000 gallon leak of chemicals. So whether that was created by a person who was intoxicated on a forklift and came into work and ran the forks into a tank or somebody attempted to steal the material or somebody breached your SCADA system and created the spill, at the end of the day, you've got a 5,000 gallon spill. So we approach risk assessment from an all hazard construct. We're also aligned with standards. So we align with the ANSI, ASIS, RIMS, RA1-2015, which is the risk assessment standard. And that was done in conjunction with the Risk Management Society and of course the American National Standards Institute. But that standard also incorporates a lot of principles from ISO 31,000 risk management and ISO 28,000 security management. So we wrapped that all up and we looked at this standard and we said, you know, we've got all this capability and what we did is we reduced risk assessment to about 22 data points. Now, our collection process is the same as any assessor in the field. We go out in the field, we do exactly what any assessor would do. What changes is how we're capturing that information and portraying it. The final report in our system from the data that's collected is portrayed in what we call a CSO's console. That CSO console aggregates the information that we've collected based on the parameters set by the CSO. So if they want to see a report for a facility, for a campus, for an enterprise, they can specify that. And it pulls down all the information, the top threats, the mitigation strategy, the risk prevention strategy. All that is pulled down into the report as well as the top 15 or 20 vulnerabilities for that grouping and the recommended mitigations for those. So that and a narrative and all that information is at a CSO's fingertips. Now, the other thing that we do is we're portraying a lot of information utilizing Microsoft BI. So we started using Microsoft Business Intelligence tools to portray about six different aspects of an assessment. One is overall risk, computed from risk threat and vulnerability and consequence. The other is crime and crime statistics. The third is threat. So there's a BI chart that portrays threat as well as project management, budgeting and a maturity model that we created that evaluates ESRM, security management, physical security, business continuity, cyber security from a physical security perspective.  And then contractual relationships, relationships with integrators, guard forces and whatnot. And we have developed KPIs for each of those areas and we can evaluate that company based on those KPIs. Not only are we evaluating the company, but in the ESRM phase of that, we're asking senior leadership to evaluate their security department as well. So it helps the security department to walk and talk security through the enterprise and gauges their maturity in that level and of course any barriers to progress or things that they're doing really well. Because it's not about finding fault, it's a very business oriented process. So I'm big into W. Edwards Deming and now we call it Lean Six Sigma, but it's all to me essentially the same. But what we're trying to do is identify issues so that we can apply a risk treatment to that issue to prevent that issue from coming and happening or at a minimum minimize its impact on the enterprise so that it's a non-issue. So that's the whole point. I've got to think that the maturation tool as well. So that's a real interesting thing that a lot of people don't, if they haven't been around any kind of CMI processes, they may not understand it. You know, having at a dashboard glance, the ability to know that, wow, my guard force and their training is mature, but maybe my cyber construct is very poor or maybe my physical is only in the middle and I really, you know, physical threats have been going up in my environment so that's where I can maybe expect to expend more resources in the coming years or it helps you plan a little bit. I love the maturity model. We looked at that for some of PSA Security Network's cyber stuff as well. It's a really good way for people to get at a glance, you know, an understanding of where they're at. Yep, and then, of course, one of the other things that we're doing is when we identify a mitigation, when we list that mitigation, it's populating a Microsoft project table. So this is a sticky process. It's not just a one and done. So what you do is as you, we export these mitigations to a project management table or Microsoft project site, as they accomplish the mitigations and they're scheduled and resourced and whatnot, once it's accomplished, we can go back in and change the risk rating and show the new risk rating based on the mitigation, which makes it a non-problem. So in essence, once you do your baseline risk assessment, you're in a state of continuous improvement until your next assessment cycle. And when you get to your next assessment cycle, you don't have to address things that you've mitigated. All you have to do is look at what hasn't been mitigated yet and any new issues that you might encounter. The good news is, I'm sorry, go ahead. That's amazing, Jeff. We got about a minute left, so if you could give some advice out to our audience from the ESRM, from that consulting hat that you wear, from an industry perspective, what would that advice be? Well, you know, there's two things. The first thing is you have to understand what risks impact your enterprise. You know, we all learn in university and senior levels in high school about the problem-solving process. You know, the first step in solving a problem is identifying the problem. Risk, threat, and vulnerability assessment in our industry is the first step of the problem-solving process. It helps us to identify the problem. So, you know, don't shortcut it, invest the money in it, do it good, do it well so that you understand the risks that impact your enterprise, and then you can align those risks and their impact on the strategy of the organization that you're working with or working for, and to help them to stay on track and understand that those risks to the corporate strategy represent significant impacts. The other thing is, is take the time to review your preparedness planning. Have a plan, train the plan, practice the plan so that when the event happens, you're not having an emergency, you're doing your job, and you're responding to the event of the day. There you go, Hawaii. From the master of ESRM. Jeff, thank you so much for sharing your wisdom and your advice with us today. I hope you guys take Jeff up on some of that. I hope you're looking at your organizations. I hope you're doing some risk planning. I hope you're looking at all of these things. It's a lot of work. Don't wait until something bad happens to get started. Jeff, thank you so much. We'll be back next week. I forget who my guest is, but I appreciate all you guys tuning in today. And if you are watching with us live we'll be on YouTube in a few hours with this episode, so catch the replay. Because security matters. Thanks so much. Aloha.


I found the trail. Oh man. I went off trail for, you know, a couple miles. I just couldn't find trail number 1032, Mountain View. Oh well. I found it now. I think I'm gonna go back and just see it for a little bit. Crazy. It's hard, man. And I have a lot of respect for race directors, but I am very intrigued at some point to direct my own race and to write my own race description. But we found it. We're good. Got a good workout off trail. Good workout. In my four hours and 12 minutes, legs are feeling tired, which is part of the goal for today. Just to feel tired and keep running through it. That's part of the goal. So feeling good. I think the next check-in will be at the Fish Creek waterfalls. I'm hoping to soak my head. Yeah, the legs, man. They're tired, but I'm able to push through. I've been going like probably about 830 to 930 pace on fairly flat trails the last five or six miles. So, all right. Love you guys. Thanks for being here, YouTube family. Oh baby. Just refueled. Just kinda walking it off and start our job. We're back. Back in the shed, back to Denver. A little storytelling snafu transpired in today's vlog didn't really have a well thought out plan, mostly because I was tired and I did get lost for a couple of miles up there in Steamboat on the run today as you saw. So, but hopefully, you know, basically I needed to focus on the running and just the trail and finding my way because I'm gonna be running about 100 miles, 102 miles in about two weeks at that same location. So, storytelling snafu transpired where I just feel like it didn't play out well between the GoPro footage and just random shots with this camera. Anyway, folks, it was a big day. I still love ya. I'm still here for ya. You know we'll be back tomorrow, but the question of the day, what is the perhaps greatest story you've ever heard? It could be a book, it could be a movie, it could be a song, I don't know, but I was just thinking and reflecting like what makes a great story and I would personally put this vlog in another category, but just got me thinking about storytelling and how to tell a story well and what makes a great story and usually there's a good twist in there or beauty or a little bit of drama is okay every now and then. A good plot development, character development, all that fun stuff makes a great story and not saying we can hit that every day on the vlog, but I wanna continue to get better at telling a story and today was just kind of a, let's grab, let's just put this in the back shelf of the archive. You know what I mean? So we love ya, we're here, we're back and happy Labor Day weekend everybody. Happy Labor Day weekend, all right, that's probably it because I'm pretty tired and I ran 32 miles today with 6,000 feet of vertical. Oh yeah, seek beauty, work hard, love each other, see you tomorrow with a better story.


What's up Mopar Fam? As you can see we are at Troy's Muffler Shop here in South Carolina and we have Frostbite in their awesome shop getting some custom mufflers put on that they build here in-house and we are having them do it up right. So let's go inside, check out the shop, check out the mufflers and let's go talk to Troy. Alright so we already have Frostbite in the shop on the lift and we are getting hooked up here at Carnage Performance Exhaust, absolutely slaying the competition. First thing I want to state is their shop is absolutely awesome. All kind of cool signs, all kind of cool things to look at everywhere you look it's just awesome. Definitely a cool shop. Kind of reminds me of John Cope's shop up here in Indiana. Very cool. It's a very nice clean legit shop guys. I don't think you'd want to go anywhere else to get your mufflers or exhaust system done, that's for sure. Frostbites up on the lift, they're putting all the masterminds to work on this thing to try to get it right and I know most you guys don't even know but that is the secret. Right there we are going out the side of the bed behind the tires with three inch exhaust on both sides of the truck. America baby, there you go. Over here Abandoned pipe. This is definitely a cool shop guys. Got to come check it out. If you want some good mufflers American made here in the States this is where you got to come right here. It's all there is to it. So not only are we getting custom mufflers built right here in their shop, American made but you get your name put on them. We got frostbite going on both of the mufflers and that is absolutely awesome right there. Definitely dope that they can do that and again USA baby. Mo Parfum as you can see and as you heard frostbite is literally ripping the truck sounds absolutely insane. The carnage mufflers sound so awesome I can't even describe it you got to hear it in person but we're gonna talk to Troy real quick about all the different mufflers that they make here at Carnage. He's gonna kind of go over the different ones what kind of sounds you could probably expect out of them so let's get to it. Alright this is our series one that's the most aggressive muffler we make that's what we put on his truck here. That's our number one seller we sell more of these than anything else. We got the series two this one basically has two baffles in it where that one only has one so it's a little milder and then we got the series prepper agent baffle with stainless steel wool so this one's pretty mild compared to the other two and we also have a diesel muffler that's on the shelf right now. This is a muscle series these are smaller bodies so we can put them like on late model Corvettes, Mustangs, Camaro's and stuff like that but those are specially made for those cars. That's the line of what we have. I really appreciate him bringing the truck up from Georgia and letting us do that job that's an awesome truck. Alright Troy I appreciate you guys working on the truck. Everybody out there and most of our people if you're close to South Carolina I just drove an hour and a half to come up to this shop and it's well worth it the shop is clean they got good people that work here they got great welders this guy I watched him bend most of the pipe on the truck and they got it done in a couple hours and that's pretty amazing. Stand up people you got an awesome product so definitely stay tuned for Frostbite we're gonna have a lot of exhaust videos coming up a lot of racing and definitely a whole new sound to the truck so stay tuned Troy I appreciate it.


Thank you and welcome to this session. You know, one of my friends who is also an agile coach actually joked with me when he looked at the agenda. He said, good luck, Evelyn, you will be competing with Mary for participants. And he said, one of his experiences was that he was in a five-track conference and he had only three participants. So then he said, he said the very thorough discussion with the three participants, he also liked it very much. So before I came, I was psychologically ready to have around three to five, so I'm so happy to see all of you are here. So a big thank you. And today I'll be presenting Building the Agile Mindset where to start. And I think that I should start the presentation with a self-introduction first since I am not that far known from compared with Mary or Linda. So I'll start with a self-introduction. And my name is Evelyn Tian and I am an Agile Head Coach from Ericsson, R&D, Northeast Asia. And I started my Agile journey in 2007 where I worked as a Squam Master and later I started working as product owner. And in 2009 I started working as a full-time Agile Coach. And with that being said, I coach individuals from developer, Squam Master, product owner and managers and I coach teams. Whether they are development teams using Squam, Kanban or leadership team. And I coach organizations through Agile transformation. And then I am also one of the key founding member of Ericsson Internal Agile Coaching Network. And we have a group of very passionate Agile coaches and who want to be together to help each other to grow and to help organization to advance with Agile transformation. And on top of that, starting from last year, within Ericsson R&D, Northeast Asia, we wanted to advance Agile transformation to the next step. And we want to have more synergy, we want to have more active sharing and learning. So last year we established an Agile coaching team at Ericsson R&D, Northeast Asia. So I have been leading and coaching the Agile team with about 18 Agile coaches who work on different products and who work in different...