Andrew, take a... Andrew, Justin, I can't hear folks, let me see if I can hear you. Hello, how's it going? Let me try that again, without being muted. It's probably me. Hi, Sarah. Hello. Oh, oh. So it might be you, Justin. Yeah, can you hear me now? I can hear you now. Okay, great. Santiago, I think you're muted. Hello. Now, can you hear me guys? Yes. So as everyone joins, please sign in. We have a pretty full agenda today. So if we could get a scribe signed up, that'd be fantastic. And we're going to have a deep dive. So the team, the intro team is back this week with a deep dive. So we're going to go through and try to take us through our agenda items and updates fairly quickly so we can have a fairly solid amount of time for in total. And, you know, I want to make sure that we also, you know, not only get the presentation in, but, you know, get a discussion now, have some time for our discussion. Sarah, thank you so much for signing in. So can I get one more person to join Sarah?  Yeah, I can do it. Thank you, Christian. Okay. So with that, once again, those who just signed on, please add yourself to the list and I'll use the attendance list to, to do check-ins. So quick check-in for me. I'll kick off the process. It's been an interesting week. I have news on the job front that I will publish here next week, but the search is done. No, it's just paperwork. And beyond that, I'm coming live from NoGist Interactive and we're doing a big collaboration event. So I've stolen a conference room and, you know, hosting from here. Let's see who's up next. Jerry, want to check in? Sure. Hello, everybody. I don't have too much to say except that I did touch base with Michael. Do you see this week? And he and I are both kind of thinking about taking a step back and reflecting all the comments that we've received about the suggested security subcategories and giving it another look. So hopefully we'll be able to do that in the next week before the next meeting. Fantastic. And we'll have an agenda item just to touch on that. And that'd be a great time to sort of poke folks to go with you. That's good. Sarah? I have also, I've been out of touch for a week and a half. Since Dan is giving personal news, I will also, um, I, uh, I lead this nonprofit CalPridge Foundry, which does like outreach and diversity and tech.  So, um, I'm back safe and catching up on things. And I did review the governance PR and I love it. Um, I, I have few minor tweaks and, um, and some stuff I want to get back and propose some specific words too. But it is just really great to see that coming together. Um, I think that the one thing that I don't know whether people want to add as an, are we going to talk about governance this time? Not this time. Okay. Let me just put it in the PR. Cause I know we've got a full agenda. I'm really like the directions. Great. Thank you. And thank you, Rachel and JJ for the effort. So, uh, Justin. All right. Um, I've been continuing to work with a spiffy and spire folks security audit. We had blog posts come out and, uh, discuss a little bit about, um, what, what we came up with. And we're looking at putting this together for an academic conference. So that's my main update. Absolutely. Right. And her, uh, and her wife. Sorry. Yep. I'll, um, so just go wait for some additional feedback on the compliance scoping doc. Um, that's out there and either that Liz and I have been putting together some additional suggestions in there that I added today, namely around, um, I ETF and other standards bodies and how they can potentially relate to some of the CNC a project landscape. So thinking spiffy tough and, and how potentially those can be proposed to those bodies if, if warranted. And then also Dan, I sent you the intros to Dr. Yorga and David Walter Meyer over in this. So feel free to, to run with that thread as you see fit. Thank you. Yeah. I've, I've, uh, uh, seen, you know, I reached out to them for, um, availability and, uh, we'll try to schedule in, uh, based on their schedules. Awesome. Thank you. And I'm sorry to jump in, but let me just say that we're definitely quite interested in I ETF standardization. We have occasionally had folks, especially from government say, Hey, wouldn't it be nice if tough was I ETF standardized? So, um, we, in fact, just had a conversation about it earlier this week. Yeah, I think that's a good idea. Yeah. Yeah. I threw it in there as a proposal. It's not something I personally will own since I'm not as familiar with the whole ITF publication process. It is a little bit involved, uh, but that is something that we should all collectively look at figuring out. Great. Um, Let can, can, uh, someone who's taking notes, uh, uh, add an action item for me to, to follow up with Justin in the picture that I'm connecting our agenda, uh, with the, um, the NIS folks. Thank you. Um, Andrew Martin. Welcome. Hello. Thank you. This is my first time on a call. Uh, I've been, been lurking on the repo for a few weeks now. Uh, so to introduce myself, I'm Andrew Martin. Um, uh, I have a consultancy called control plane, um, in London and we're focused on ultimately a container and Kubernetes security engineering. Um, but it's basically, uh, that narrow scope is obviously much wider when you consider, uh, how does the container get to be, what's it coming through pipeline, et cetera. So we're just basically doing kind of dev sec ops, uh, with container as focus. And, um, we've been working with Santiago for the past, uh, few months, probably so far now. Um, deploying in total with, uh, with, uh, a web-facing customer in the UK. Um, and, uh, I'm just helping to sort of bring some commercial requirements back down. Um, I mean, lovely time. Everything's going very nicely. Um, so hello. I'm very pleased to be here and hope to be on speed. Awesome. Welcome. Erica. I actually just flew back from London yesterday. I have for the week. Uh, just, uh, did a little intro to Kubernetes for CNCF thing. Uh, so I mostly don't have, we canceled the working group for Kubernetes this week. Uh, that, I think that's amazing. The thing though that I've been thinking and wondering about in particular for the Kubernetes case is how to, uh, deal with concurrent. See an or concurrent events and distributed systems and whether it makes sense to have the, like, full gates at certain points. Or what does that mean? When there are. You know, multiple timelines of the truth going on. And especially also what that means for like, attributing actions to any one individual, should we look at ways of extending that? Thinking about it more comprehensively. That's all I've got. Erica, while you're here, could I ask if you could check off an agenda item and, um, you know, share with folks the, thank you for posting about the, um, Kubseq. Uh, can you just sort of share a second on, on that and what folks should be, uh, preparing in terms of the CFP. Sure. Uh, I think cube sec, cube con is the big event in the Kubernetes world and because everyone in Kubernetes only thinks about the Kubernetes world and that's like the entire thing. Um, it's a big deal. So there's a lot of, uh, code located events. One of which is red hat. I think, uh, AWS and aqua sec are sponsoring specifically devoted for enterprise security. So that I think it's a, the clients are or the people who would be attending and interested are those who are trying to deal with security in the enterprise and the, like the real situations of the compliance and larger demands at. So those are the things that we're going to be discussing there. End user focused. So, uh, or, so, uh, customer like enterprise customer. And supplier focused. I don't know. There are many developers who think I'm developing this specifically for a large financial organization. There's a lot of apps in that space. But yeah. Um, Enterprise customer or some kind of user of security, right? Well, everyone's a user of security, whether it's good security, different story. Good point. Is there an interest in like having a, uh, a working group level discussion? Would that be appropriate? Um, you know, for us. At, um, Cube sec. Or around then. Right. I'm down to meet up with anyone and everyone. Right. So we're going to have, you know, in, uh, um, you know, a QCon at cloud. We'll have the sort of normal, normally sanctioned working group events, uh, through that. Uh, I was just wondering if, if we should prioritize anything for the, the cube sec thing, or if that's, uh, you know, if we're not appropriate there. I would need to get in touch with the organizers. Cool. I was in more of an engineer side. Yeah. I'm more helping and participating rather than organizing. Well, I'm sure it fits within the scope and like subject for sure. I just don't know. I feel not. Um, you know, I present the plan is sort of, and we'll continue and we'll organize something at cube con general.  Thank you. Uh, Christian. I actually don't have anything to report. My last note was from this meeting last week. Everything else was internal. Cool. Good to see you. Mark. Come back. Hey guys. Uh, nothing too much new. We're about to watch our internal. Uh, container POC next week. So. I was catching up with the issues from the meeting. So, uh, we're going to have a, we're going to have a week after less. So I'll have those three posted up here before this meeting ends. That's, that's about it from here. Excellent. Okay. Um, nothing new from my side as well. And it's still waiting for the five G security working group to, uh, uh, make the organized swim. Excellent. Thank you. Santiago. Uh, hello. Yeah. Uh, Most of this week, I just prepared this presentation pretty much. Uh, and, uh, I reviewed a little bit about the government's documents. Uh, mostly to gain inspiration because we're also starting to like get a more formal process to like. Start building your total standards and, uh, the attribution guidelines and posts of conduct. Excellent. Rachel. Um, I address concerns that were left. In the governance stock PR as of. Like 90 and this morning I saw just before this call, there were new comments and those are not addressed. So if you have any more comments, there's a little bit more time open. Excellent. Thanks, Rachel. Is there anyone who I haven't called on, uh, who wasn't checked in? Got everybody. All right. So just going through the, the last little bit of agenda items. I want to get into, um, The into, into deep dive. Um, So, uh, the compliance, uh, document, uh, Andrew Ward, where's, where's the new, um, new material? What should we be looking there? Posted it. Yeah. In the chat there. Okay. So it's pretty high level. It's pretty short concise. Uh, Let's put the initial draft together. I've added a few additional suggestions in there, but we go. Uh, and there's a couple of comments on the side. So. Have we, I haven't had a chance to schedule you for this. I was, uh, away during a week. Did you go through this? Uh, Entire proposal, um, you know, with the working group here. Uh, not formally, not yet. Uh, we've had some conversations just on the GitHub issue, but I have to go through it now or at another. Would you be available next week to do that? Let me check. Yeah, I can do next week. Awesome. Let's schedule that for next week.  Sure. Yeah. And if anyone else has any suggestions, please. Don't hesitate to add them on. Excellent. Excellent. All right.  Uh, I've kept it in just to keep the, um, You know, our attention, uh, focused on it. Anything new that we're, um, That you're looking for specific feedback back on. So I don't think that there is anything new that I'm looking for feedback on, but one of the things that I'm going to be thinking about and reflecting on the next week is whether the subcategories are well named. And I suspect that it would be helpful to get the perspectives of People who come from different backgrounds on that. Um, So that's one thing that I would really like everybody to just kind of take a look through and see if the name of each subcategory resonates with you, or if there's something that you think we could modify to make it, uh, more generally applicable or just clearer. At this point, you have you, um, we've gotten rid of kind of, uh, All of the examples and, and, uh, our, is everything now, uh, Sort of the descriptor and the definition. Is that that? I mean, that could potentially use improvements too. That's all part of what I'll be looking at in the next week. So I would say that if you feel like you could offer an interesting perspective on that, or even if, you know, you're not sure if your perspective would be interesting on that.  Ask questions. Yeah. Hopefully we can get all of our feedback together and pull it into a, A more final draft. Excellent. Thanks a lot. All right. Well, let's, uh, yeah. Today we have, uh, Santiago and, uh, Justin and they're going to, uh, Thank you for the, the introduction last week. And we're going to go into, uh, a deeper dive on that and, uh, then have some time for discussion at the end. So, um, Santiago, are you presenting? Uh, yes. Awesome. So do you know where the, the sharing? Yeah. Do you have slides? Uh, let's see if this works on my machine. Yeah.  Lights. No. Looks good. Yep. Good. Okay. Great. Take it away. Just to give some context. I tried to, my understanding from what you mentioned last week is, uh, that, uh, uh, the C and C application process was changing into a presentation. And, uh, this presentation was kind of the first draft to see exactly how they may look like. So I tried to pretty much take a look at existing DLC guidelines for applications. Uh, try to massage it into something that was a presentable form. Uh, I also took some content that I had.  So, yeah, I think everyone here already knows that I'm all about in total. I'm, and, uh, like I would say, I have a longer just in the lead signer of this solution. And I'm going to talk about how it matches the club native landscape and how it, uh, it's very necessary for securing, uh, like next generation cloud native solutions. Now, it's probably the application. We need a description. So I just put a slide in there. Uh, in terms of framework to secure supply chains in and out of the cloud. Uh, most of current cloud native deployments use a very, like, very diverse, very, like, configurable, uh, graphs of notes that interact with each other. And they, most of them perform operations and artifacts to either do quality assurance, like a vulnerability scanner or a transformation, say the Docker field or a, or a regular build or a linting or anything like this. Now, something that I want to, I wanted to, like, uh, to do is to give a little bit more of background to as to what this means in terms of the description. And I'm going to use a very, like idealized, uh, supply chain. And, uh, I'm going to walk through exactly how things can break in this context. Now, all of you may like laugh about how simple this is, but it's pretty much like a very, very balanced application that you may check in into GitHub. You may be using, uh, a build system. I think this logo is messing. I forgot what it was. Uh, you may be checking it in a CI system to run tests, uh, Travis or whatever you want to use. And you may do some packaging. Um, in this case, we're building a dot that file. Uh, as all of us, like, uh, in the same group knows, uh, all of the single points of failure, uh, can be attacked in this case. Uh, for example, I'm going to use a, uh, can be attacked in this case. Uh, for example, you can break into the version control system and you can introduce back doors as it has happened many times before. Uh, or you could, for example, uh, try to break into the build system and, uh, use a backdoor in compiler and, uh, or create a backdoor version of Xcode to introduce backdoors in mobile applications and so on and so forth. Or you can compromise the packaging infrastructure and introduce, uh, uh, a backward version of the whole, uh, final product and so on and so forth. Or as it has happened before, you can sometimes even by mistake, forget about CI and just release the untested versions of windows, uh, and update everyone's machines and kind of break it for a couple of hours. Um, and that's not the only thing. Uh, you can also, even though there's point solutions of working this, uh, I made some patches to get to, like, increase the security of our metadata store. You can use sort of solutions today. And most of you, I started familiar with, uh, tough, which is a solution that takes care of, uh, what would be this, which is the last mile of, uh, software delivery. Uh, it has pretty much resulted in many, in securing many things that you guys are, like, familiar with. Uh, you may recognize the logo in there. Uh, and, uh, and yeah, like, all of this is good news if you secure individual aspects, but the complete problem is not fixed. Uh, there's gaps between steps, which is, uh, how, uh, there's notes interact together. And there's also a matter of compliance. You can, sometimes, even though the step exists, you really are not listening to what the, for example, the security scanner is telling you. So, what in total is all about is to secure the complete supply chain. In total is, uh, means as a whole in Latin, and, uh, it is not a coincidence. We really want to do a holistic, complete, thorough, verification of the supply chain as a whole. In, uh, key points, this means that we want to verify all the final steps of the software supply chain. We want to verifiably define who's able to enter, to perform operations in the supply chain, and which operations, and then guarantee that everything happens to, how this, uh, definition is done, and in no other way. So, to do this, we pretty much used two things, a layout, and, uh, attestations, and forms of link metadata. Now, a layout, here's like a, toy version of it. It's pretty much, uh, what steps exist. In the toy example that I showed before, well, we had a version control system, a CI system, we had a build server, and we have a package here. Uh, it also tells you who's able to do what, for example, while it's only able to interact with a version control system, and Dave, who is the owner of Travis, is the one that's performing the build, and Carl and Aaron will be the ones to build and package the final application. We also have a, in the layout, we have a rules, a series of rules to define how these artifacts interrelated to each other, to make sure that, uh, all of the artifact flow is done properly. In this case, the resources that were created by Bob and no one else are the ones that we needed to check down in the CI system, and the ones that are needed to be sent over to the, to the build server. And what Carl built is what, it's the only thing, only what Carl built is going to go into the packaging infrastructure. And it also has a signature to authenticate who created this layout. Uh, in this case, we know that Alice is the owner or this C-cell of the company, and she's the one that says exactly how the software is built, and that's why we have her signature on this layout file. The, counterpart to the layout file, the other, the other piece of metadata is what we call links, and links are essentially at the stations that each of the actors that were, uh, selected in the layout, uh, create every time they perform an operation. For example, created, uh, created a source code or checked out source code, he will report in a link what was in the version control system. In this case, uh, you will see in the bottom left that it says foo and a pure hash of foo. So that's what we're going to use uh, to link things together. And, uh, finally, once we have all of the links and layout and the final product, we bundle all together and send it to the inducer. This can be, uh, a package manager. This can be a, an admission controller in the case of the cloud or it can be just a general audit scanner that you can put inside of your container or extrader to like, continuously verify that all of your images were produced properly. Now, this is the big picture. Uh, I don't know how much of a deep dive you guys, uh, want. I don't know that we do want me to go deep into the specifics of the layout or is that a yes? Okay. Yes. Sorry. Yeah, please do. Yeah, but I saw the yes. Okay. So, it's out of the layout. Uh, I already said that what are the key one, one thing I do want to mention to us is that we will be doing a demo where you'll also have the opportunity to see a lot of this. So, even if we go through this a little quickly now, um, there'll be a good point later to stop us or stop us now, whatever you prefer. Thanks for the context. Okay. So, uh, so basically in the layout, as I said, it's essentially a policy that you define for your supply chain and how everything connects together. Uh, in this case, uh, the key points to consider steps, what are, what are the steps that we perform? Functionaries, which are the people that operate on this flight chain and, uh, a series of rules to make the steps together. There's also other useful information like an expiration date. You may want your layout to expire so you can take the policy forcefully every couple of months, for example. And of course, it has a signature over the whole thing. So, you know, the layout is to be trusted that the right person, um, created layout. Inside of the layout, you find something that are called steps or step definitions. Uh, they essentially describe who's able to perform the step and it contains a series of rules that will, uh, limit and interconnect steps together. Uh, for example, this is an exact, this is a very simple rule. It says, create food.py. That means that the person who is, uh, performing that step is allowed to create the file called food. Uh, in this case, the artifact food is a file. Uh, we are the idea is that it's, this is really agnostic to the type of artifacts. For example, in the cloud, you may have Docker images. So, you may want to specify uh, uh, uh, Docker build step. It's actually building a Docker image with this stack. Um, in this case, of course, for energy control system, there's no food and then there's food and you want to like ensure that this happens. Uh, another example of an artifact rule match, which is what you use to, uh, link steps together. Match, uh, in this case, match is matching food.dy that was created on the tag release step. So, for example, this was done in the build, uh, in the build step, you want to only use the artifacts that were created in the tag release step. In this case, it was food.dy file. You want to make it so that the version control system is correct Uh, another, like, interesting element inside of the layout is what we call inspections. Uh, so far, we only know who did what and how the artifacts interconnect, interconnect together. For example, you may want to know if your CI system doesn't have any instance of the word warning inside of it or if you are running a vulnerability scanner and you want to like, verifiably ensure that there's a CD and I forgot the acronym, a score higher than seven, then you may, you could put an inspection within it, which will essentially unpack the link metadata and verify that the specifics of that link uh, follow further rules. Um, an example that we're doing with Git is uh, today you can do signed push and you can link them together. You can pass this signed push uh, certificates forward and you can use them for example in force that only certain uh, people merged into master or that uh, no people that are not allowed into the project created any commits or that no commits are inside. That's the kind of information that you would try to do another like shuffle this work awesome. Is this font size good? Oof, a little small. Better? Better. Awesome. Okay, so uh, in this demo we're essentially going to follow what the what I did for the presentation. I'll essentially use the in total Python implementation to create a layout. We'll see the layouts together. Um, and then we're going to simulate all of the functionary sacked into the supply chain until we have the verification step and we can verify and we can see that everything's verified properly. So, trying to zoom in just for so remember Alice is the one that creates a layout. She's the she's a project owner. I made a I needed to install total. Okay. So now now I created a layout file just to give a little bit of a of a like a quick dive on what's on it. You can see that there's a bunch of rules in it that are connecting all the steps together. There's a bunch of public keys of the functionaries that are saved into the layout and if you see there's a key ID field here that's the key ID is the one that we put on the steps for example this is a step and that's how we tell that for example this packaging step let me highlight this packaging step here is signed by the key that got there. Okay. Finally we have a signature all the way in the bottom. This is the signature of Alice that essentially authenticates this layout. Now I always created a layout we have a couple of functionaries that need to perform steps. Let me remove the links that I left from a demo yesterday. So what I'm going to run now is a step in the supply chain. This is basically we're using the in total tool chain to do what you would usually do which is check out the repository check out the repository and then create the sign of the station of that specific checkout. So in this case we created this piece of link metadata when we run get checkout that created an attestation of the operation that we perform. These attestations this piece of link metadata are what we're going to use later to essentially build this graph and verify that everything is proper. Inside of the link you can see there's for example the file that was tracked for the UI and then secure hash of it and then there's a signature of Bob saying hey I actually performed this step since the product of performing this step. Now say that we have another step for example before release increasing the version number of the project. So if you guys see now we have a full.py we have full version zero but we want to increase it just to showcase another another tool say that we instead of having them or actually now that we have them it is a little hard to wrap them using encoder run. So what we can do instead is use encoder record which is essentially taking a snapshot of the state of the file system and of the host before running which we do here and then we can we can conveniently edit the version number and then we can stop recording and save a piece of link metadata that will essentially be the statement of what we did. Now as you guys see this new piece of link metadata that we created by recording both states it originally had the secure hash of full.py that was checked out in the version control system and then as a product it recorded the new secure hash of the full.py which is how we're going to start tracking artifacts as they move in the supply chain. Now we're going to move to the last step in the supply chain which is Carl is going to package what Bob did. So for this I'm going to copy the demo project from Carl and we're going to use encoder run again we're going to wrap tar tar you see again we're using the wrapper we pass a step name a couple of hints to the tool so it knows how to sign it and which artifacts to like pay attention to if you don't pass this it will just track everything which is a little slower and then the command that we're running in this case the package link it tracked the full.py as it came in which as we can see this is how we are linking the update version step with the package and finally we have a the demo project RGC that's the product of the packaging and finally we want to verify all of this so clean this out for this we pretty much just need Alice's public key the layout the links and the final product itself that we want to verify in this case it's the demo project it's this package so again we need a public key couple of links the artifact that we want to verify the final product and the layout that's going to tell us everything that's about this like we run our verification command we pass what's the root layout and then we pass the key that's layout and if I didn't screw up I screwed up it actually caught that I probably did something wrong in this case it says the match between the clone and yeah between the clone and the update version number doesn't match oh no actually it's because if we look at the clone link that's this yeah okay so I see what's wrong I didn't remove the demo project when I run the clone step yeah now it actually run the clone step but I performed a step since the repository existed because I didn't clean up properly the step was failing we can actually see that the return value is now zero if you check out the final product the old version of the link metadata the return value was 128 which meant that the step had failed so now we run the verification and now everything works unintendedly I I showed what this is all about I committed a mistake when doing the clone and it was caught like a photo which is great news now I'm going to go back to the presentation just to finalize with a little bit more of the formalities of the whole maybe we can take a couple of questions here we've had a few oh yeah so Erica just asked if in Toto handles key or link revocation so no we'll use the implicit revocation using expiration dates but we don't have an explicit mechanism something that I'll talk a little bit in the roadmap is that notary and tough for example are great additions for handling namespacing of the metadata for projects and for explicitly revocating certain namespaces within the supply chain without rotating the whole the whole layout for example this is something obtained handles right obtained has a lot of interesting features that can be cool to not be so vehicle specific yeah yeah there's it within this currently in Toto doesn't have a separate time server component but if you if you shift and verified in Toto metadata from a tough repository or an obtained repository then you automatically get that so it's not sort of like foisted into the system as a separable thing it's something that seems that you you have this it does there are ways like you can do key and link revocation and stuff like that and in Toto but there isn't a separate explicit time server like there is with obtained yeah something to add to that is that tough and in Toto are very like metadata friendly each other one of the one of the integration that we have right now they're actually using tough just like get the complete supply chain security out of the box excellent so Mark you had a question about metadata and Andrew has one about validating reference integrity hmm hopefully get to the chat I want to let you go first because mine is kind of a meta question go ahead Andrew yeah so this is good stuff thanks for taking the time to share this is there a way to use in Toto to validate referential integrity between artifacts so you mentioned that artifacts can really be anything from binaries to source code packages and whatnot but let's say I have some sort of artifact that's maybe an attestation artifact in the context of risk management how can I validate that that artifact is you know from who it says it's from and then it's being updated something that we do have is the concept of sub-layout so you can essentially part of your supply chain steps be part of a third party supply chain say that you're using a couple of Debian packages in your Docker build you can verify that those Debian packages themselves were made on a proper supply chain layout that's practices and everything within it is verifiably using in total too is this what you were asking yeah that's exactly it I think there's another component too that kind of comes up here which is that you can also interrelate aspects of how your other things got built and how they work together so for instance if you're saying you know the library that I'm using here should be built by the same compiler as the main thing as the main project or something like that yep also validate and verify that all those sorts of things have happened so all those all the sorts of things like this you can imagine expressing are expressible in total in this way okay very cool thank you another question real quick related how to sort of verify the information flows are secure so what is I mean especially in situations where the system is running on itself or triggering other actions is there a way we can kind of incorporate and have a you know have a security model proven security model let me see like there is in Linux I'm sorry so like SE Linux you know kind of based on like the velaputo model there's a few other ones once you have these like interconnecting which is what we're dealing with a lot right so some thing that we do have in the metadata and right now it's kind of like a break structure is environment information environment dictionary that you can expect something that we've been like thinking with and we don't have like anything formal yet is to for example have TPM at the stations inside of the environment dictionary about the whole whole system integrity using my security or something I don't know if this is answers your question or did I go in another line it was another one of my questions okay we can just I will I will quickly say that we have a very detailed analysis like like on the level of what we did for tough about why in total is secure including you know link metadata tampering and layout tampering and other things like that and what scenarios it loses security and to what degree so I think that is probably closer to the answer to your question and we can talk more about that later but I think Santiago you want to maybe move on with the rest of the presentation just so we can be sure we get through it sure okay so roadmap thanks for working a lot on now getting out is trying to formalize like governance documents which is like how to interact with the whole community how to get changes in I've been trying to get the thinking of like adding code covenants that are like called default code conduct of this we're also working on cloud native enhancements we don't have the specification a URI artifact definition but it's pretty much just something we need to formalize we are working with Grappias if you guys know these guys we're trying to get them to use interchangeable metadata and to help them fix their security model we also something that we're working on is we want to integrate the in total and top in a more formal way and probably even launch service using to provide layout registration and namespacing of the layouts you could essentially like let's encrypt for your artifact layouts and then some this is something that I haven't shared with the data verification you could use it in the cloud as a container not only an admission controller but as a continuous verification anytime you revoke a piece of metadata you could pull a container out and you could revoke a piece of metadata by for example redoing a cd scanning and finding that there's new vulnerability of certain degree and revoke the metadata and as a consequence essentially pull any unsafe image from the cloud I know there's similar solutions to this but this could be just like a very simple elegant and automatic way to do things on Beyond Cloud Native we will probably launch with the reproducible builds people the reproducer set up and then in total transport that you can use to fetch your devian packages and make sure that they're reproducibly built something that we wanted to do is integrate the build kit to like start identifying artifacts and verifying them as they're pulling in they're being pulled in into your entire images which goes similar in the vein of what Andy was asking we're also thinking of adding security enhancements and formalizing them H7 and TPM support we already support UVTs using TPG signatures but we probably want to do something a little bit more like like on a general grade not only like RFC for 4880 we also want to have hostile testations which is something that I just like mentioned using like TPMs to authenticate the whole host and provide read-only boxes for building and performing steps and this GX Cloud Builders would be something that I'd love to work on we also have a go implementation on the works to like deal with cloud native environments and layout scanning a very nice consequence of this is that you can essentially just check a layout and see if someone is doing best CII practices for example can you define a layout real quick what you mean by a layout? policy the big file that I made in the beginning contains the steps and signatures and the public keys of the people that should do that is that good? yes did I lose connection? yeah that's great go ahead sorry and well we have a couple of integrations going oh there's related work there's pssdx already Peter we're all in the same like supply chain environment authentication artifact visualization cloud native artifact recording as for pssdx then this is like the big integrations that we have right now we have a on the bottom right there are very homebrewed projects that are already releasing in total metadata Andrew here may recognize the logo of his company here and music we also we actually hit production today and data dog in the new agent and we are also reproducible builds we are taking care of the reproducer setup which is this thing that I spoke about and I already I'm an arch developer by the way I use arch and and we also we also are working with the graphias to like fix this the security model and to provide us with a transport that can help us provide more cloud native metadata transfer between like all of the like super distributed systems that are in the cloud there's also other people that are interested we have some talks with Docker we have some integration with the open system I also work with the deviant people and I don't know which other we spoke with Gavretti and Peter I know the developer of Peter he wants to like essentially merge the metadata there's so much going on that's like there's only so much things you can focus on at the same time other information that is required it's part of the application we have a tentative tentative sponsorship from Alexis Richardson we don't know yet we would like to join an incubation we have in total current project sponsor I really don't know exactly what this I don't know if I have to say NSF just in problems better and the license is Apache we actually got all the signatures to re-license as Apache as of Monday we used to EMIT we have all of these code repositories to your disposal only the ones that have a star are not Apache but they can be changed later actually yeah and then dependency license I think this is just formalisms that we need to go through there's a bunch of different components of what we've released these are our communication channels you can always join IRC I'll be there with a couple of lots and a couple of developers you can join our mailing list and you can I don't know how this works on Slack but we're also there we have a couple of websites up you can use our design tool to create your layouts today we actually updated it to the latest poster in total in our in the labs website we have this release cannons we are very devoted to semantic versioning I take when people don't do it we do release candidates release candidates candidates monthly or sometimes even faster depending if it's a batch release yet with a major feature at the same time and we're still don't know when to release the major version so we cannot say like a timeline for each major version to be released these are the initial committers two years ago I checked the logs we have 13 committers in the reference implementation and 16 contributors among all of the projects that I put out the mission controller the cube controller plug-in the Jenkins plug-in et cetera et cetera et cetera and all these are pre-pictured any questions you put the slide up with the URLs again this this that's it thanks no problem yeah sorry if I flip through faster this I was looking at the clock can you put a link to the slide into the document sure something that I wanted to ask Andrew Martin I'm sharing this but I know there's information about your company so I don't know and I mean just those two logos I don't know how like my understanding is that that is fine so I will just change that up for final confirmation but yeah give me one moment okay you can share with this group which is gated okay yeah I I'll do that should I get yeah I'll send it I'll send it on the emails for everybody I think I have access to that or is there a better way I'm not I'm not too familiar with Google really Christian we'll put this into the minutes if you share that so just the share will link or yeah that's perfect okay so right before folks drop I want to make sure I have time to sort of see if we can do some triangulation um Andrew in the um safe compliance work that we're you know currently scoping is there anything that we can um kind of leverage in Toto to inform where we're going with that compliance journey and you know provide additional feedback to TOC to Lexis and to Ken what do you think Andrew do you have to go? sorry that was our mute um yeah so I was actually just talking about this with a couple of folks on my side I think if we can get um a couple of new folks to talk about the work that's taking place with with OSCAL the open security controls and assessment language I think something like in Toto can fit in really nicely with that I think there's a lot of value here in merging those two for sure great okay um so next week we'll have uh Andrew we'll kick off some of the discussion around uh the safe light scoping uh you know once again we're we're still working on the security landscape for CNCF landscape and association with CNCF landscape uh review both of those documents you know we appreciate the attention there um Santiago and um um um and Justin uh thank you so much for joining us today uh this was fantastic and uh I can let a little bit of overflow time if folks have a little bit more discussion that wanted to uh have around this you know are there any further questions that we you know folks would like it to get into before we wrap up today because Mark I just put this on the agenda for a future conversation because I think it needs more than three minutes but uh the issue of metadata management is is a thorny one and the uh the FSISAC group which is you know to follow provenance for data and you've got the same set of issues there how do you map from these domain specific models for what's in the metadata to things that are interoperable to other tools like even in the in the NIST stack how do you you know map to other things like threat representations and the difference between a policy and an attribute and even the name of an application we're going to ask this project to address that but maybe there's some you know groundbreaking stuff we can do by trying to inject some kind of model-based representation at the ground floor of a project like this right so so we've actually thought about this specific issue in a couple of different contexts a lot um and our philosophy with this to this point is that these models and these ways of having these general abstractions sort of um static enough that in our opinion it makes sense at this time to invest an enormous amount of effort in them so instead what we're focused on is making sure that the actual um metadata and the actual um cryptographically verifiable aspects of this are all um are all produced in a way that is verifiable and non-modifiable and so on across these contexts so and then you know if something like that has a richer model like for instance Grafias from Google has a richer model for some of these aspects of things in the cloud then that layer is perfectly well on top of what we're doing and now we've provided the metadata they can actually trust we're hitting this in Kubernetes quite directly where there's no standardized place to store metadata that are like annotations on the objects themselves but those have no access control separate from the objects themselves so that one's a very complicated one is that there needs to be kind of almost field-specific access policies per thing um which gets that multi-dimensionality is very difficult to handle and would want to know longer conversation yeah I mean this is one of those interdisciplinary problems right because the modeling folks have solutions for this you know you could argue that schema.org out of Google's maybe a better representation that you could do reasoning with than the traditional security models that we inherit from Active Directory but you know there's a lot of work to do six to nine months of painful time with Santiago on dead ends until we realize this one I believe it I believe it well so Mark and Erica I'll take an action item to schedule and you know probably be two three maybe four meetings out a discussion around metadata management come back and have a deeper dive about metadata doesn't stop that's not a joke that's actually what you think about it now you want to know who attached that metadata which is already touched by internal theoretical sir well thanks again everybody have a wonderful weekend and we'll see you next week thank you thank you everybody thanks all


Two years ago I was genuinely so scared that it was too late to make the switch to computer science and I'm just really really glad that I had the courage to change my life. I'm really grateful for the one-credit girls-encoded computer science class that I took. I 100% would not be in computer science now if it wasn't for that. They really made it feel like a safe space like women really do belong in CS. We learned Python and it was so crazy to learn like how fun and creative computer science actually was. It brought together a lot of the things that I already loved like I loved being creative. I loved art. I never thought that working with a computer would be similar to my art classes. I'm really glad that I had that class. It connected me with a lot of people in computer science and a lot of mentors and I actually ended up becoming an IA for that class later and I was able to mentor other students and help them be comfortable in CS. 183 has honestly been one of my favorite classes at the university. They were really focused on getting students interested and getting them excited and it was like so welcoming. It just like brought out all the cool things that you could do in CS. Computer science has really reignited an ambition in me. I have the tools at my fingertips to do so many things. My name is Danine Huss. I'm a senior in computer science now and I'm going to be graduating in May. I'm working for M-City which is an autonomous vehicle testing track here. I also just said yes to J.P. Morgan Chase to become a full-time software developer and I'm super excited about it.


Mentoring is important because one, it helps you to see someone who has gone before you and has achieved something that you want to become. Mentoring is what got me into security. I started off in technology and I found my mentor by helping her on a project. She started pulling me into meetings so I could start hearing discussions. She gave me books to read. We talked about all the different kind of roles that existed and ended up giving me my first job in security. So I'm always grateful to her for that and I think just having that person you can bounce things off of who maybe isn't directly in your team just can make the world of difference and broaden your perspective so, so much. I learned as much from my mentees I think as they learned from me and having that collaboration and that sharing of experiences, I got so much out of it. And the one thing I let my mentees know is that once you've been through a program like this or you have a year or two in the industry under your belt, you now are ready to mentor others and help bring others up into the community. The talks, they save me in other expert led discussions, especially the one on cryptography and cryptanalysis and the one on law and cyber crime. Those are very interesting topics for me as a woman in cyber and they really helped me open my eyes to practical things that I can use to grow myself in those two key areas. I would recommend this to other women in cyber security field because one is from some statistics is that we form less than 25% of the workforce for the cyber world and we need more women and for us to do that we need a community that encourages us. This program had some of the most amazing mentors I've seen. So you have women who are at the top of their game from all over the world who want to come and contribute. You have an opportunity to get a world view that you wouldn't necessarily have another opportunity to get. And I would highly recommend coming on board and joining the different classes, the key notes, these incredible mentors. It's a very unique experience.


It looks like it's time to go ahead and get started. So my name's Will. I work at Neo4j, which is a graph database. Has anyone used Neo4j or graph database before? No, OK, great. A bunch of new stuff we'll cover then. So I'm going to be talking about graphs and sensors, the internet of connected things. So I work on the developer relations team at Neo4j. I just say, really, I work for the Neo technology, which is the commercial entity that supports the open source Neo4j project. And on the developer relations team, I work with a lot of users, hands on basically trying to help them be successful using Neo4j for their projects. And there have been several IoT projects that we've worked on with some sort of shared use cases and takeaways. And so the goal of this talk is to introduce you to the concept of graphs and graph databases and share some of these IoT use cases that we're seeing some users adopting. So this is the rough agenda. We'll talk about what graph databases are. We'll do a demo in Neo4j so we can familiarize ourselves with the data model, the query language, and then we'll jump in to looking at some use cases where it makes sense to use graphs along with IoT. So when we were brainstorming this talk with some of my colleagues, we were trying to approach this from the first person's perspective of a sensor, sort of a lonely sensor that's looking for connection in the context of graphs and graph databases. And we ended up calling this the mushroom talk because it actually maybe requires some psychedelics to put yourself in the first person state of mind of the sensor. And then doing a little bit more research into that, well, there's actually a lot of sensors involved in mushroom cultivation. You have things like temperature, humidity, these kinds of things. So anyway, side note, internally I think of this as the mushroom talk. OK, so on to graphs. So when we're talking about graphs in terms of graph databases, we're not talking necessarily about data visualization, but we're definitely not talking about charts. So these are charts, and this is a graph. What's the difference? Well, when we say graph, we're talking about some data structure, specifically nodes. Nodes are the entities in the graph relationships connect nodes. What kind of data can we model as a graph? What can we store in a graph database? Well, this could be information about a person that has a checking account at some bank. We can see the relationships between these entities. We could be talking about a hotel that has rooms. Each room has some availability calendar associated with it. We can model, this is a graph. We can also model devices that are listening on ports on certain IPs, what organizations own the IPs, and how geolocation ties into that. Where's that IP located? So really, when you start to think in terms of graphs, I really think that graphs are everywhere, and you start to see graph problems everywhere that you look. So let's talk a little bit more about this graph data model, specifically with Neo4j and most graph databases. They use a data model called the property graph data model. So we said that nodes are the entities. Nodes can also have one or more labels that get at the type or the class of the thing. So here, we have two nodes that are labeled person, one that's labeled car to represent those types of things. We store key value pair properties on nodes as well. So here, we have a node with the name Dan, the date that Dan was born, his Twitter handle. Similarly for the car and for Ann, we have key value pair properties that are specific to those data points. Now relationships, we said connect the nodes. Relationships have a type, a single type, and also a direction. So in this case, Dan loves Ann. And it's good that Ann also returns that. That's modeled sort of as two different relationships. And also in relationships, we store key value pair properties. So that's the basic data model. Now we need a query language to work with graphs. And that query language in Neo4j is Cypher. Cypher is all about pattern matching. So the basic idea with defining patterns in Cypher is nodes are defined within parentheses, relationships within brackets. So you end up drawing these sort of ASCII arts representation of graphs to represent the pattern that you're looking for. And in this case, this is a create statement. So if we ran this against our database, we'd create two nodes, one for Dan, one for Ann, with this loves relationship connecting them. We'll see some more Cypher examples, but this is the basic idea. Just think of pattern matching and drawing ASCII art to represent the pattern you're looking for. Cypher, I should point out, is really open Cypher. It's an open source language that is becoming a standard for working with graphs, not just on Neo4j, but also other graph databases and also in some graph processing frameworks as well. OK, so that's sort of a whirlwind introduction to graph databases in Neo4j. We talked about the data model, this idea of nodes and relationships. We didn't talk about this, but there's an important property of graph databases, this idea of native graph processing. This means essentially that I can traverse the graph very, very efficiently. This means that we can work with very, very large data sets at scale in the graph. We talked about open Cypher, the query language. We will look at this in a minute, the Neo4j browser, which is sort of a query workbench for interacting with Neo4j. And of course, Neo4j is open source, so you can download, build it from source, get started with no problem. Cool, so let's look at a little demo with some actual data in Neo4j. So I pulled down some data from Shodan. Anyone used Shodan before? A few people. So Shodan is, well, as they say, the search engine for the internet of things. So Shodan scans lots of different ports on IPs and sees what response they get. And based on sort of the known ports and the response, they're able to identify databases, cameras that are listening on these ports, industrial control systems, and so on. So I grabbed some data from Shodan. You can export this in a CSV format. So this is an example doing a search for cameras that are available. So you can see we get information about the IP, the hostname, country operating system, these kind of things. And Cypher has some really great functionality for importing directly from CSV format. So this is just a quick load CSV script in Cypher to load this data from Shodan into Neo4j. Essentially, what we do is iterate over each row of the CSV file, extract the fields we're interested in, things like the IP address, city organization, and define the graph pattern that we want to create with that data. I'll try to quit moving. And so this is the graph model that we end up with. Saw this earlier. We saw this earlier. But let's jump into Neo4j browser and actually look at some of this. So this is Neo4j browser. It's, as I said, sort of a query workbench for writing Cypher queries, visualizing the results from Neo4j. And we can jump into some saved queries here. So first thing we want to do is look for any cameras that we've imported. So we want to define the graph pattern that we're looking for. Well, we're using the camera label to indicate that this device is specifically a camera that's listening on a certain port. And that port is connected to a certain IP. And then we're just looking for the first. The first match of that path that we have, and just returning that. And here we can see, OK, so here's some device that happens to be a camera listening on port 554 and on some IP address. We can traverse out from this IP and see that, well, this IP is in Korea. It's registered to Korea Telecom. We can traverse out from Korea Telecom and see what are other IPs that have devices exposed as well. So these are some basic traversals we can do in the graph. Let's look for things in Portland. So let's match on, in this case, the city node where the city name is Portland and return that. And we find any devices that are exposed in Portland. And we do. We find 32, it looks like. And so we can traverse out from these and see the organization that owns these. Or we can just write a more complex Cypher query. That's going to say, OK, starting from Portland, let's traverse out to find all the IPs connected to Portland what ports that we have industrial control systems listening on. And also, let's find out what are the organizations that have registered those IP addresses. So if we run this, we get a nice graph here. And this is showing us, so here's Portland in the center here. These purple nodes are the IP addresses that have some industrial control system. This is specifically one called Niagara, which is used for things like building heating, elevator control, that sort of thing. And we can see these green nodes. These are the organizations that have registered the IP. And so if we look at these, a lot of these are internet service providers. Here's one potentially interesting. This is Star Park, LLC, which owns a bunch of parking lots in Portland, potentially interesting there. So anyway, that hopefully gives you an idea of how we can work with data in Neo4j, what the query language looks like, and some of the visualization components. And we already saw these. These are in the slides just to reference later. OK, so let's talk about some actual use cases where it makes sense to use graphs along with devices. So I'm going to say sensors a lot, sort of as a general term for devices that generate some data and connect to the network. I think there are lots of sensors that are generating data and uploading, streaming this data to the cloud. And I think we're at the point now where we're able to handle the streaming data. We're able to do anomaly detection, things like this, with the streaming data. But what I think is really important that we haven't necessarily focused on is looking at the connections in these sensors. So we can do things like look at power consumption, networking, again, streaming data. But really, when we start working with this data in graphs, we realize that there's lots of value in the connections in our sensor and device networks. So let's look at a first example here, just a simple sensor or device network. So in blue, these are 18 sensors that are connected to four different wireless access points, two switches, one router, so standard network configuration. And we notice that there's a problem here. We're not getting readings from four of our sensors. Well, if we look at this network topology, we can see, well, okay, they share the same wireless access point. That's a potential point of failure. And of course, we can look at this topology. This is fairly simple and sort of figure this out. But how can we express this programmatically in Cypher using a graph model? Well, here's what that might look like. We have depends on relationships connecting our sensors to the wireless access point. And maybe each sensor has an ID. So we can match on each specific sensor and find any component that they depend on. This is how we would express that in Cypher. And we may want to find all components that have connections to disabled sensors. And so we can do this. We can also do an aggregation to tell us sort of the number of sensors that each component has that has connections to that is disabled. And we can go one stop further and say, okay, show me components that have this depends on relationship with sensors that are disabled that do not have any connections to sensors that are not disabled. So essentially show me components where every connection to that component is down. And this is a problem if we find that. That means that something's not right. We need to do some maintenance. So let's say we're going to take down this switch. Well, we can traverse the graph to find sort of all of the sensors that are going to be impacted by taking down this switch by traversing out downstream to find any device that will be impacted. This is the idea of a blast radius. So if one device goes down, what's going to be impacted in Cypher? We have this handy variable length path operator. So which is the asterisk here in that relationship. So we can specify traverse paths of any number of relationships. So any number of hops down this depends on path what's going to be impacted. So if this red node goes out, we can see everything that it depends on through many, many different different relationships. So dependency analysis. This is a great use case where graphs can add some value and especially by looking at the connection or sorry, the topology of your sensor network. So okay, so let's look at another one. So what about relationship between sensors? So imagine a oil and gas pipeline where we have lots of sensors at different points in our pipeline and they're constantly streaming out readings, things like temperature, pressure, flow, these kinds of things. Okay, and so a common approach is to use something like Kafka to create Kafka topics that can consume data generated by these sensors. So that allows us to handle the streaming nature of the data.  So for example, let's say we have a sensor that starts to report back very high temperatures. Storm will tell us very, very quickly, hey, there's an anomaly here, something's going on with this sensor. And okay, that's useful. But with graphs and by looking at the structure of our network of sensors, we can first of all verify that this actually is an anomaly rather than just maybe a sensor going out. How do we do that? Well, we can look at the readings from our adjacent sensors. So this is an oil and gas pipeline. We know sort of approximately what each temperature and pressure observation should be based on the flow in the network. So we can say, okay, for a sensor that is apparently undergoing an anomaly, what are the adjacent sensors within some radius and what are the observations that we're getting from those sensors? Are they consistent with an anomaly occurring? So this helps us verify that the anomaly is occurring. If there is some anomaly, we can also use the structure of the network to reroute flow in the oil pipeline to avoid this anomaly to alleviate some additional temperature or pressure while still maintaining flow in the network. Cool, so let's talk about another benefit when working with graphs and that's the ability to sort of join data sets. Graph model is very flexible, allows you to easily combine data sets and query across them. This is a common use case for graphs and when we do this now with the sensor world, it allows us to connect sort of other real life sources towards sensor data. So an example of this is ADSB. This is Automatic Dependent Surveillance Broadcast which is commonly used in aircraft. So most aircraft in the US carry these and they're constantly emitting information that represents their altitude, their velocity, their location, their tail number, this kind of information. Now there's also lots of public information on aircraft registry, who owns the aircraft, what organizations own the organizations that own the aircraft, maintenance records, safety records, thing like this. So what could you do if you combine the readings from ADSB and some of this aircraft registry information? Well, the graph model might look something like this. So we have not just information about the plane and its location but we can also tie in the manufacturer, the model of the plane, its manufacturer, maintenance records, and so on. And if we have data like this, what could we build? Well, we could build a Twitter bot that tweets out anytime a plane owned by a dictator flies into or out of the Geneva airport. We could monitor flights within the US and tie those to planes known to be owned by the government specifically for government surveillance to sort of track what areas the government is surveilling based on ownership records. So these are the types of things that people are using this concept of combining these sorts of registries with IoT data. And so in the final use case that I wanna talk about is this idea of recommendations. So everyone has been exposed to some sort of product recommendations, sort of personalized recommendation. So think of Netflix, here are movies you might be interested in based on movies that you've watched on Amazon, products you may be interested in purchasing based on your browsing history, these kinds of things. And this concept translates over into the physical world, in retail specifically as well. So we think of the layout of a grocery store and we think of this concept of the loyalty card. So even though we're not purchasing online, of course the grocery store is tracking our purchase history through using our credit card, again tracking our loyalty card purchases. So we have some record of preferences that we've expressed, think of product ratings, purchases, that kind of thing. And then in retail we see many of these location-aware apps that allow retailers to track customers throughout the store. And we've even seen these sort of in-store display ads that are changing based on the composition of the customers in that area. So if we've found that we have customers who may be interested in a specific product based on their purchasing history and we have a concentration of those customers, we can switch the promotions on the in-store display ad. So what kind of data goes in? Goes in to do that, what might the graph model for something like that look like? Well again, we're just combining the physical location of the user, what department they're in in the store with their purchase history from our retailer's transaction catalog. So and again, this is just pointing out that the typical architecture for something like this, the benefit of using the graph is this ability to combine sort of data silos where we have lots of different information about users and different pieces of the organization, a graph is a very flexible model to be able to work with that. Cool, so if you're interested in learning more about graph databases, there's a download for this O'Reilly book, graphdatabases.com. There's a lot of use cases, code samples, good way to get started. And sort of the takeaways I guess that I hope I got across from talking about some of these use cases are that there's more value to be derived from the structure of your sensor network with graphs and then also the ability for combining data sets from both sensors and from other sources and graphs are a good way to do that. So that's all I have, any questions? Okay, well thanks everyone.


Hello, so this video is a response to a question that I get so many times Pretty much three four times a week People ask me the question Oh Robbie, like you're awesome. How did you start and I always tell them, you know It's kind of a really stupid question Because you can take like Michael Jordan or you know, the most successful person at anything They always start bad Like nobody just started and did it right.  So don't ask. How did you start ask? What did you do that made that turn your project into a success or or? What happened or what did you do? That got you on the success track Because everyone that's successful Usually went through a couple of years of doing it wrong before they started doing it, right? Sorry site engine Anyway, the purpose of this video is again sort of a response to this question by me giving you kind of The best tips I could say for you know, it's starting your own business And this isn't like some, you know these videos that you know five tips for business thing and it's always like These weird five tips where you're like, oh, I knew that like, you know, that's not very helpful So no, these are extremely practical and out of the box. So you probably didn't hear or think about them so number one is Realize the importance of attention And again, this is a bit of a rehash of all the content that I put out, but it's a summary So number one attention is the the key attention is the number one thing you need To get anything done. It doesn't matter how if you have a good business idea a bad business idea If you have a good product a bad product the service, you know, whatever it is if you don't have attention You're not making sales You're not you don't even you're not even in the vicinity of making a sale because people are not, you know They're not glued to you. There's no eyes on you. So even before you have a product You want to get attention Start a YouTube channel start a Facebook page Instagram Snapchat, you know, whatever just as much as many channels as possible and start promoting already and when I say promoting The definition of promoting is getting things to the people's attention Does that make sense getting things to the people's attention? So getting you Or your business if you want to be behind the business, you know that some people like to be the business like me Some people like to be behind the business You know kind of like Bill Gates, for example versus Steve Jobs Steve Jobs liked to be the face of Apple Bill Gates like to be like to be behind I know in the background so First step again attention is is the key you have to start with attention. You have to get attention if you don't get attention You don't get anything So it's not the product. It's not the service. It's not the idea. It's not the strategy. It's the attention start getting attention already No matter if you don't have anything to sell because once you do you'll already have the attention Make sense cool second thing is Whatever it is you're gonna sell Make it Find something expensive to sell and forget about your limiting beliefs for a second Oh, you know this I'm not good enough to sell this so never mind imagine it somebody else the first thing you want to do is Start telling the what's called the bread and butter. So obviously if I'm a coach and I write books You know, so my first book is gonna be released soon. It's gonna be out for what like 1999 maybe 2999 You know $40 50 $70 I mean If it's 4999 I'd have to sell a hundred just to get $5,000 Now a hundred sales It's not a lot But it is a lot When you start the business when just you just started the business Unless you do ads, but again in that case you still have very low margins. It's not gonna work. Trust me Not not on your first attempt. So I'm here to make it easy for you so you want to start with a High-ticket item something expensive that you can sell What can you sell for a thousand dollars? What can you sell for two thousand dollars three thousand dollars? $10,000 Maybe it's a certain service. Maybe it's con consultations Where you have something you're good at and you can just help people You know, we just it doesn't matter and I can help you think of a product if you want But it has to be something something, you know expensive because you want to create a situation where you can just make like two three four sales and that's enough to Have you in abundance not just, you know, okay Or barely getting by but actually in abundance. So if you have a two thousand dollar product You make two sales. You're at four thousand dollars. Just two sales Which brings me to point number three What I would do is I'd start by focusing on Phone calls phone sales. I mean now, I know most of you don't like sales And I'm not I'm not saying you need to call people and try to sell them Even if you don't want to go the route that I went and you know publish tons of content When you sell something for two thousand dollars, you have extremely high Profit margins if it's online because you're not selling a car.   Can you buy? But you know make it more You know put them in a long video, you know the ad should take them to a long video Like if half an hour video and then if they watch it they get a link, you know make it very Filtered so that you only get the best of the best, you know, maybe you can use a long form Like, you know, how much are you willing to spend and blah blah blah? Just make sure it's a good lead a Warm lead a hot lead and not just you know Somebody who just oh this looks nice, you know make it a bit of a Difficulty to actually get in contact with you now once I actually Got in contact with contact with you Because they are the ones who contacted you and again, you made sure it's only the people who are like really serious It's not gonna be hard to sell. It's gonna be it's not gonna be like a sales thing You know, it's like we try to like present it and you know closing tactics, although, you know You might add that but you don't need that as long as you kind of sound like you know what you're saying so you'll be able to To sell every third or fourth or fifth or six calls so even let's say it's one in every six calls And it's not like force. It's just you know, okay. Yeah, you don't know what it awesome. No, you know, there's no pressure So if it six calls and it's like 30 $50 per lead dude That's just three hundred dollars in expenses Meaning you still have a profit of 17 3700 $1700 sorry for $1700 which is like 20% they think for expenses It's basically a 75 80% profit margin So that's tip number three again number one focus on attention number two high high prices number three Sell on the phone, but get them to call you So number four delegation This is a continuation of the idea of setting a large prices And I'm not saying large prices like inflating them. I'm saying like you know start with the expensive stuff not the bonuses You that will be useful when you try to get to a large audience But we're talking about Solvency first, you know, creating a business that already generates a lot of money from the beginning so number two again, it's because it's High prices What high prices do is that they give you a lot of margin. That's why number three again You can use calls which even increases the margin more because now it's not like internet You know one in a hundred people one in two hundred or five thousand people buy, you know You get a couple of leads one of them ban like closes but Let's see if I can fix the light. No, I guess I'm going to be dark for now Now the fourth tip Which again is a continuation of the second tip you can only do that if you have a large profit margin is Leveraging people What does that mean? when you have a big pie You can slice parts of it and still have a lot left when you have a hundred dollar sale You don't have anything to do with it because let's say, you know Every lead cost fifty dollars because you suck You don't have any profit margins. You have to make a sale on the first lead or you get even or lose Let's say the price is five hundred again.  Let's say you don't like to sell or Let's say You know, you just don't think that's your job. You're like you want to be like a CEO guy, you know You can literally just get somebody Like like search forums, maybe your friends, you know, you'll find you can find them in all places and say hey I'm looking for somebody to help me sell my product I'm interviewing people that want to sell my product on the phone You can do it from home Basically, they schedule the call. You just show up for the call and make a sale. I don't pay you anything Except commissions. So you do a sale. Sorry, you do a sale you get money you get 15% so $300 15% for the marketing and then another 15% $300 for The commission for the sale You basically just created a model because 30% of the of the income goes to expenses marketing and Commissions employees, you know salespeople that pretty much do the work for you now What do you have left to do so You have an automatic system for example that that generates leads or let's say if I keep uploading the videos and I grow, you know, even more even the way it is right now and I say, okay, you know, you want to contact me. It's fine. And then I hire like an assistant Again, pay him by commission and an assistant, you know Oh, it's mark quotations An assistant or if you want to talk to me to talk to him and then he tries to sell you on Me so I just make the videos and he makes the sale and I know that because You watch my videos. You're probably gonna be a good match for me But again, that's against my style because I like to talk personally with the client But let's say that I sold a product for $2,000 or let's say that I had Product service combination were for example, there's a product and you do like a group call with me You know where I don't really if it's a group call I don't really mind the quality of the person because you know You it's not like you and me. It's not like an intimate thing. It's you know, you 30 people. So who cares? Or again, let's say we're talking about you You might create a product Okay, let's say you're not pre creating a product. You can just give the service So let's say it's not, you know coaching which is personal because you have to kind of get to know the person Let's say it's something like, you know fixing a website or you know doing something that's a bit more Kind of not personal Where you don't really need to know the person you just need to be able to solve the problem You don't really care who you're working with because it's not intimate for example, like like Robert Cislow Grant Cardone's director of production What he does Is make videos and he says I don't care if it's a I like the client. I don't like the client I make the sale, you know, he charges like $2,500 makes the video Who cares? He doesn't mind So so somebody else makes the sale for you the expense the marketing is done by somebody else You basically just provide the service you want to make it even cooler even cooler Let's say it's the video service the video production service and You're not You don't want to be Robert Cislow or you're not Robert Cislow. By the way, what's the interview I did with him? Really really good. So So you're not him, okay, or you don't want to be him.  You have to be at the office Seven days a week six or five days a week seven hours a day. You have to do that.  Like hey, I like to make videos and this is a side income and I edit like five six videos a month For $300 each So I get an extra 1500 $1800 a month for doing what I love and And some people want to be you know small thing So they don't want to be the guys who who get the leads and get the sale and you know promote They just want to do the thing It's as if for example me as a coach I would be like no I don't want to you know market and sell and everything I just want to get the clients You know and there are avenues for that, but you're not going to get the full payments So I won't be able to I wouldn't be able to charge, you know $2000 if somebody was setting up the calls for me doing everything for me because You know, I would be like the small screw. I would be part of the big company that hires coaches That makes sense. I hope it does so you go by that idea and Look what we've done here. We're basically built a full model Out of a few basic axioms and ideas so number one attention You realize that it starts with attention That that's that's a mind shifter. That's just to realize that that's what matters at the end of the day number two You find something you can sell for more than a thousand dollars 2000 is perfect if you can do more even better, but 2000 is the ideal Well, I wouldn't call it the ideal but the optimal because it's it's fairly easy to sell 2000 is completely possible also 2500 you know 2000 to 3000 completely possible optimal Both in terms of difficulty and in terms of reward when you go above 3000 You know 5000 10,000 it takes more sales skills. You need or you need to sell something more special or maybe to a bigger client It's completely possible. It's just beyond my area of expertise. That's why I'm not You know codifying it because the biggest I sold was five thousand dollars and I didn't like it But that's for another video so you essentially make these sales and And you make them again by 15 percent to the marketing 15 percent To the guy who sells and then you can even have 15 percent to the guy who delivers So you get 45 percent a bit less than half meaning no nine hundred dollars roughly. Oh, exactly nine hundred dollars goes to People who helped you But you get the rest you get fifty five percent so you get $1,100 and this is an automatic system So you basically don't need to do anything Besides keep it running and scale it so up this video kind of helps you understand the The ideas of what I'm trying to put forth the the model the thinking Let me know if there's anything that you don't understand anything that you think I should add Because I want to make sure this is tight. I want to make sure you get this Completely, okay so let me know in the comments if this helped you let me know how you liked it and I'm here for a late night meeting So I'll be seeing you very soon Love your feedback. Please give me feedback. Please. Please. Please give me feedback And let me know if you want to coach I do coaching talk soon


Live from Las Vegas, it's theCUBE, covering Magento Imagine 2019, brought to you by Adobe. Hey, welcome back to theCUBE. Lisa Martin with Jeff Frick in Las Vegas at the win for Magento Imagine 2019. We're excited to welcome to theCUBE TJ Gamble, not only the CEO of Jamerson, but a Magento master. That's the big one right there. Right? Yeah, that's the important one. Don't forget that one. Well, one of the things I wish our audience could see is an awesome orange cape that you and the other masters were wearing this morning. If I had known, if I had known, I'd have brought the cape, but the cape's going to get framed and put up somewhere, so we tucked it away in the bag. So you have been a Magento advocate, part of this massive community of over 300,000 that they have accumulated in the years for a long time now. This is the first Imagine post-Adobe acquisition. What is your take on this year's event? How is this community in the year since the acquisition was announced? The community is a little apprehensive, a little concerned. Change is always a concern for people. Things are going so well, Magento's growing. Everything is positive for it, and then you have Adobe come in and acquire it. So people are, they're on edge a little bit, but I think you come to conferences like this and you see the announcement of them rolling Sensei into it and channels, the Amazon channels they're rolling in, and you start to see the acceleration of features and innovation that Adobe brings when they bring those level of resources. And so I think people are starting to really kind of get over that nervousness and start to feel the excitement of where the platform is going, and it's just about to explode and get even bigger. What's a whole bunch of resources, right? The new investment, and as you've seen it kind of change hands a couple of times as an independent company, then go into eBay, then out of eBay, private equity, and now into Adobe, and yet the community has been very, very grounded and stuck with the platform all the way around. Open source is a huge part of this story. Small, medium-sized business is a huge part of this story. You have some really big announcements today kind of integrating into the Amazon e-commerce system, integrating into the Google shopping systems. And I still can't believe that Adobe didn't have an e-commerce platform before they brought a Magento. It fits perfectly into this kind of funnel process. It could not fit any better if they had built it from the ground up themselves. You know, if you didn't see at least the promise of it right away, then maybe you weren't paying attention, it fits into what Adobe's doing just incredibly, because Adobe's all about experience. And so Magento being the most flexible e-commerce platform in the world, it does not have the limits that some of the other platforms have. So if you can envision it, if your customers desire it, you can deliver it on the Magento platform, which is what made it just, I mean, it's, like I say, it's just a perfect fit into the Adobe ecosystem. And I don't know why they didn't have an e-commerce platform. I don't know if they've tried and failed. I didn't keep up with the history of Adobe like I have Magento, but I'm glad we're here. I'm glad it worked out that way because it's going to be good for everybody. What are some of the things that you're hearing from those small and medium businesses? As Jeff was mentioning this morning, the announcement of the Amazon sales channel integration with the free extensions and the marketplace, Google Shopping, aimed at assuaging the fears that some of those small and medium sized businesses may have had in the last year of being acquired by an company at Adobe that has a very strong enterprise presence? Yeah, it's not so much those features are, it's, you're starting to see the investment so that's good, but those features are more about, e-commerce is getting more complicated. You're going to have to start selling in multiple channels. You're going to have to start selling on all of the social platforms. Facebook's going to eventually roll something out. They're already doing it with WhatsApp. Instagram just announced the checkout within their site. So there's a lot of things you've got to manage and data is difficult. So anytime a platform can out of the box handle a lot of those integrations, you can now manage Amazon. You can now manage your Google products right in your e-commerce platform and it becomes the hub for small merchants to run their business. Because most small merchants don't have a complex ERP as their hub for their data. Or a lot of resources, right? Exactly, so if the e-com platform can help you manage that data so you can focus on properly merchandising, that's great for everybody because small merchants, the have and the have nots, the gap is widening. And so small merchants are going to have to have tools that they can leverage to keep up. Because they're never going to be able to throw the money at it like somebody else can. I mean, Amazon is spending $800 million next quarter. Three months, they're spending $800 million to go from two day prime to one day prime. Like how is anybody supposed to keep up with that?  It's a great example, bringing it to the customers. And I'm curious to get kind of your take on the small, medium e-commerce players out there, this kind of experience message, right? It's a big piece of the Adobe story. We were at Adobe some at a couple of weeks back and clearly they've got a ton of resources when they talk about this ongoing engagement with the client, be with them wherever they are, let them shop wherever they are. Like I said, that's easy if you got a lot of resources but I'm curious, are smaller merchants seeing that? Are they changing the way that they go to market where it is more of an experience and the products come along? Or a lot of them that's just too big for them to bite? Both, you see both. It depends on the maturity of the merchants, what kind of resources they actually have to dedicate to it. The great thing about experience is once you have a platform with limitations like an Instagram checkout, that is an experience. Instagram handles the experience for you. So somebody finds a product, they one click and they've ordered that product and all of the canceling that order, all of the notifications go through that platform. So they've made that very easy for a merchant to have that top level experience. If you're a small mom and pop and you gain access to Instagram checkout, it's going to be the exact same experience as the big brands that have access to it as long as you understand your audience and you're creating posts to engage with them and you know how to merchandise your products. You don't have to worry about the technology stack. So I think this is going to be the great equalizer with where merchants are actually interacting with their customers. It's going to be a huge opportunity. But what about kind of the competition with somebody like in Amazon where on one hand it's a great distribution channel for me as a small merchant. I've got some specialty items but I used to always joke, right? Good news just got in order from Walmart. Bad news has just gotten in order from Walmart, right? So the scale issues, as you mentioned Instagram, suddenly I turn on Instagram and my cup goes viral. How are small merchants kind of playing both sides of that coin? I want to play with Amazon. I want to use their distribution technology. I want to use Instagram, Instapay, but at the same time I've got limited resources. Oh my God, one of these things hits and I get 100,000 orders pop up on my system tomorrow. I'm in trouble. How are people managing that? How are you helping them kind of strategize? Well, you want to find the right tools. You need to understand your customers. You need to understand where to best engage them. And if you have limited resources, you have to be selective. You have to figure out which one is the best. Like if I have all my customers on Instagram, then that makes sense. But if all my customers are on Twitter, then why am I putting resources into Instagram? So you figure out which platform is best. When it comes to Amazon, you know, not to quote, we don't want to quote 90s rap on here, but in the words of the immortal too short, you should be getting it while the getting's good, right? Take advantage of it while it's there, but sooner or later, they're going to own your market. You understand that. You go in with eyes wide open that sooner or later, if you're successful, Amazon is going to take over your market share that you're getting from their platform.  These other platforms, it's a little different because Amazon's dangerous because they own the channel, the actual medium and the platform by which transactions are happening, but they're also a competitor on that platform, which is what makes them dangerous. And when you get in that situation, they're just so many gray areas. We've never been in that situation before. The good thing about these other social channels is that they're the medium, but they're not also competing. Like Instagram is not selling on their platform. So there's something's going to happen with Amazon. Every juggernaut dies at some point. We may be 100 years from now before we see that happen, but something's going to have to happen to stop Amazon. We can't have one platform that is also a competitor in the space be 75, 80, 90% of all e-commerce. We just can't have it. So something's going to happen between now and when we get there. And I'm not, you know, Nostradamus, I'm not going to prognosticate what that is, but changes are going to happen over the next five years because that's just not a market conducive to competition. Speaking of changes, there's a lot of change going on with the expectation of consumers, which we are every day for many products and services that we want to have a personalized experience. We also want to be able to do everything from our smartphone. So this rise of at least it's starting a transaction or a buying process on mobile is really critical. One of the things also announced today was progressive web apps. Where to get your perspective on that as a game changer in the next gen for shopping and how might that enable a small to medium business to compete better with its competitors on Amazon itself? Yeah, PWA is if you don't know what a progressive web app is, you need to go do research right now. It was, they've definitely mentioned it today. It wasn't necessarily announced. It was announced, I want to say a year and a half, two years ago now they've been working on PWA studio in Magento for a while. Progressive web apps are a Google initiative and Google usually gets what it wants. We won't talk too much about accelerated mobile pages or anything like that, but usually if Google's pushing it, it's a good thing. PWA's are interesting because they're not a technology. They're a methodology. It's like responsive web design. It is just best practices for how you should deliver a mobile experience. But it's a single page application which means you load your app once and then elements when you're moving through the site, elements that are the same don't refresh. Like if the navigation, the header's the same. When you click, it's still there. It doesn't flicker, it doesn't jump. It lazy loads things in so it brings things in as it needs it to save time so that it loads faster and to save data because mobile, usually you're on a cell network when you're doing that. It touches on all of the important aspects of e-commerce which is why it's coming fast. Number one, you're going to have increased conversions because if you can browse around the website and it's snappy and it's fast, you're much more likely to order something. So you've got increased conversions there. That's number one. Number two, you're going to get more traffic because it's a Google initiative. Google rewards fast websites. So if you do it properly and you've got the SEO right, Google's going to send you more traffic. And so it also leads to more loyalty because you can have a more pleasant user experience and your customers like you. And really in e-commerce there's only three stats that really matter when it comes to how much money you're taking in. How many new customers can you get, right? It goes back to the conversion rates and Google sending you stuff. How much do they order? Well, they're more likely to order more when it's fast and they go right through and they can browse through a thousand products really quickly and then how frequently do they order from you? That's it. Every other stat in e-commerce trickles down to those and PWA touches on all three of those, which is what's going to make it happen and happen really fast. Right now, if you move into PWA, it's a little bit of a risk, a little bit. That risk lowers every day. So if you're watching this two months from now, the risk is a lot lower. But the technology's new. The tooling is a little new. It still needs to mature a little bit to be readily available for the masses and affordable, especially for smaller merchants. But if you do move now, you can have a serious competitive advantage for years. If you're building a website right now, you 100% need to at least look into PWAs. If you're going to launch it later this year, you're going to launch it early next year, you absolutely have to look at it. And if you're going to start the website next year sometime, I really, it's going to be an odd case that launches a website by summer of next year or after that is not a progressive web app. Like it's going to be that fast. T.J., I want to get your perspective on something else that we were talking about here at the show, and that's AI. And talk of AI and machine learning for a long time, that's what we kind of suspected. Really, the easy applications for those are inside somebody else's application. We're seeing Adobe use AI on the back end, on all the marketing side, because the whole idea is to get you what you want. And as somebody once said, if it's done poorly, it's creepy. If it's done well, it's magic. So I wonder if you can kind of reflect on how AI is changing kind of what you can build and what you can deliver to the customer, even if you're an SMB, because you're leveraging AI back in systems, way back supporting you. Yeah, the AI is, it's a buzz term right now. And buzz terms are always really popular about five years before they're useful. And we're probably a couple of years into AI really being a huge buzz term. So it's starting to creep down market with something like Sensei being added to Magento. You're going to see it creep even further down market. So I'm excited about it. What AI and e-commerce, where it's really going to play is understanding your customers in real time. Those who understand their customers can provide a better experience. And how do you understand your customer, the differences between them, what they're looking for in real time while they're interacting with your website? That's really difficult to do and it's impossible to do without something like artificial intelligence. So leveraging it for your product recommendations, for your search, for what content you're going to show to them. It's still going to be a lot of work unless we figure out how to AI create all that content. Still going to be a lot of work, but just having the ability to understand the subtle nuances and differences between your customers and their desires and then to be able to actually react to those in real time is going to be incredible. Especially as there is not only so much noise out there, but there is so much competition, pretty much every product and service. TJ, we thank you so much for joining us on theCUBE this afternoon. Next time you've got to come back with your Orange Magento MasterCade. I'll bring the tape, if they would have just told me how to brought it. But I'm sorry. You have to come back. I know, now I've got an excuse. I'll forget it next time, so I have to come back again. There you go. All right, TJ, thank you so much for joining us. We appreciate your insights. For Jeff Frick, I'm Lisa Martin. You're watching theCUBE live from Las Vegas. Magento, imagine 2019. Thanks for watching.