Okay, moving on, we have the first of two double acts today, next up. So we're going to talk about the topic of using standards to secure the digital product life cycle. And it's great to welcome Altaz Velani and Rob Akashok. So Altaz is the Director of Insights Research at Security Compass, and he conducts ongoing research in the software security domain. Prior to joining Security Compass, he was a Senior Research Director and Executive Advisor at Infotech Research Group, providing trusted advice around application development, application rationalization, agile, cloud, mobile, and the SDLC. Other past positions include senior manager at KPMG and other positions working alongside senior stakeholders to drive business value through software development. Altaz is currently the Vice Chair of the Open Group Security Forum, a member of the Safe Code Technical Leadership Council, and also sits in industry working groups at IEEE, Cloud Security Alliance, OASIS, and the OMG, where security, DevSecOps, and privacy challenges are being discussed with broad global impact. So welcome Altaz. Joining Altaz is Rob Akashok, the IT Management Architect at DXC and co-chair of the IT for IT Forum within the Open Group. Rob helps IT organizations to transform to become a lean and agile service provider, ready to manage the new digital ecosystem consisting of a hybrid cloud and multi-vendor sourcing landscape. He's architecting the new IT organization, combining standards, practices, and concepts, such as IT for IT, TOGETH, Scaled Agile Framework, DevOps and continuous delivery and security management with established IT service management methodologies such as ITIL. He assists IT organizations in their automation journey, covering the entire IT value chain including portfolio management, the DevOps tool chain including CICD, test management, monitoring, and event management, risk and security management, ITSM, OMDB, cloud orchestration, etc. So we're in very good hands this morning to hear about using standards to secure the digital product lifecycle. Over to you Altaz and Rob. Welcome. Yes, Steve. Great. Thank you very much. If we could go to the next slide please Rob. So thank you everybody very much for allowing Rob and me the opportunity to present today. We believe that there exists a gap in the industry today that helps to bridge security and digital delivery and the use of standards to achieve this integration represents a tremendous opportunity for the open group to influence and to make a difference in how we're able to help organizations balance this need for both speed of delivery and security and this will come up a number of times in our presentation today. Insofar as the presentation goes there will be four parts to the presentation. We will start by looking at the broader context. In particular we will highlight the security and risk challenges in a digital ecosystem and then we will turn our attention to describe practices in a secure digital operating model and in this part of our presentation we will talk about this idea of a digital product backbone that natively incorporates security practices and what we will do is walk through a use case of the recent log 4j vulnerability to demonstrate how something like this can be useful. At the end of this presentation today we will describe a joint initiative that's taking place between the security forum and the IT for IT forum in helping to create a security reference architecture and at the end of this we'll open it up if you've got any questions please don't hesitate Rob and I would be delighted to answer any questions that you might have. Next slide please. Now when we examine current security practices it's common to see something like this. So broadly speaking we have preventive, detective, responsive practices and there's some kind of an overlay around development and operational activities. The preventive controls are typically exercised at the earlier stages of software delivery and we see a push towards the left of more and more security activities. During the development process we also engage in a number of security tests that help us to detect vulnerabilities prior to deployment and the combination of these preventive and detective controls operate both on the development and operational side so at the bottom of the slide you will see we've even got infrastructure elements so we typically see infrastructure as code and a lot of as code activities today. Normally what happens when we look at DevOps it is the delivery mechanism is done through these DevOps pipelines and they're essentially an integrated set of technologies that enable us to automate much of the CICD pipeline. And finally we have all the way to the right these responsive practices and these are typically executed based on some kind of a stimulus that requires remediation from a security perspective. And this really overall represents where we are today in a number of cases. Now the challenge with this type of model is it misses out on several other contexts. So for example, how do we propose bridging the gap between security and delivery teams? We could slow development down but that's not going to work. We could ignore security and that's not going to work either. And so this brings us now to our next slide. If we could go to the next slide please Rob. So really when we look at security and digital delivery there are multiple stakeholders that we need to consider. Here we've highlighted four groups two at the executive level two at the practitioner level and we've highlighted some examples of where these groups might fit in and what are some of the common roles that we see. So we're going to drill down a little bit deeper now and show you the model that we've developed within Security Compass that we're open to sharing. Next slide please. So within our own efforts we've probed further and this is what the security executive persona looks like. We found that they are focused largely on formulating the right controls in order to reduce risk to the organization in an auditable way. You'll notice that their focus is on a higher level of abstraction here. So the intent is to come up with something that allows risk mitigation organizationally. If you go to the next slide please. When we look at our security practitioners the focus for security practitioner is largely on identifying threats and attackers. And the intent is to try and look for ways to engineer mitigations against these threats and ultimately thwarting any kind of effort for malicious actors. But you'll notice that there are a number of different concepts that converge when we talk about a security practitioner. And the intent here is if you look at what they're finding important in terms of their day-to-day activities they're looking for evidence, root cause analysis a number of these things. Next slide please. And then when we now take a look at the tech executive. The tech executives typically being our CIOs or CTOs. They're focused largely on processes, runbooks, infrastructure. The ability to construct an auditable way to ensure that when we have to report back to the business from a security perspective that our infrastructure and our technologies are in fact secure. And we provide assurance from that perspective. Next slide please. And finally when we get to the tech practitioner the tech practitioner are where we see a lot of our DevOps engineers and their focus is on code, on deployment of software, looking at the infrastructure and ultimately trying to figure out what is the best way for us to go in and to insert security as we go through our delivery pipelines. And this is what we're going to talk about where the convergence of these two is occurring but there isn't a simple way to go in there in terms of an architecture or a framework that will enable this to happen. And at this point I'd like to hand it over to you Rob to explain a little bit in more detail now that we've got an overview of where the challenges sit. Where do we go from here? So over to you. Yeah, so the next step I would like to take you through a short journey of what we see as the initial draft ideas about the security reference architecture. As you probably also know that many organizations are currently changing their digital operating model. They look at how do we deliver value, generate flow, automate, streamline activities. And here you see an example of looking at the end-to-end value streams and in IT we have multiple value streams but one of the key ones of course how do we deliver from an idea getting something in production for example. But what you see is that we have different practices that people starting to use nowadays like TOGA for the enterprise architecture, agile frameworks for development and like SAFE as a former skilled agile perspective, agile development, DevOps, site reliability engineering and we still use ITIL for a lot of service management practices all about continuous planning, continuous delivery, continuous operations and continuous improvement and leveraging IT for IT for example to basically fuel your digital operating model. But the challenge that we see now is that how can we incorporate security and risk management practices into these primary delivery models. And you see there's a whole range of security practices out there. It's a very fragmented and isolated tooling process landscape as well as a tooling landscape by the way. We have risk management practices, security management practices like testing like OVOS. There are many regulatory frameworks for controls like COVID and ISO 27000. There is now initiatives for zero trust. There is NIST as a good example for cybersecurity and incident management. And the challenge that we see nowadays there are so many controls, policy frameworks we need to implement. There are many different security and risk management practices but now our goal with the security reference architecture is how can we incorporate all these best practices and codify that into an end-to-end digital delivery model. And that's why I would like to basically give an example of how that would work in an end-to-end delivery model. And here you see an example of how does my digital supply chain looks like from an end-to-end perspective. And this is basically how organizations are currently looking at their digital delivery model. They have portfolio backlog management. Their source code, development, testing tools, change management, monitoring and security somehow needs to fit in. And I would like to show you how does the security management capabilities and model fit into this overall model. It seems by the way that we have an old slide pack here so maybe what I can do is share my own desktop so we have the latest version if that is okay. Can I do that easily to share my own screen? Yes, of course Rob, go ahead. Yeah, thank you. Just let me know if you can see my screen again. Okay. You see here the digital supply chain. Yeah? That's good. Okay, thank you. So basically what I was saying, we have a digital supply chain. You see here some of the key building blocks if you will based on IT for IT what you need to run a digital organization. Now let's take an example of how security practices and basically components are embedded into your digital delivery model. Let's assume we would like to introduce a new product or service and it could be like a new business opportunity to improve our customer journeys or maybe we need to replace or consolidate something but let's assume we're going to create a new digital product. A key element in a digital life cycle is that we have a single registry of all our digital products and in the past we call this an application portfolio maybe but now digital product portfolio tightly linked to our enterprise architecture capability. So we can identify this new digital product who owns this product. Where is it linked to in our business process model? What data is managed there? And of course there is a moment in time that we're going to basically mobilize a new team, a product team and a product owner that's going to build this new product in incremental ways like it could be an MVP first and here you see that we create the backlog in a basically in a product team backlog. We have the CISD pipeline that needs to be set up. There is requirements and design still generated and here this is the one of the first steps to mobilize this team leveraging continuous delivery tools for example to populate that. Now one of the first security and risk components that we need to address is risk management. Many organizations have not really implemented a good risk management capability. They do risk assessments in Excel but it's not always tightly linked as this example into your portfolio of digital products and your architecture. So what we need is a solid risk management capability where we can address like security impact assessment, privacy impact assessment, vendor risk impact assessment against my product linked that to how does this product enable my business process? What data? What are my user community? What technology components do I use? And out of that we basically need to generate what kind of security controls and privacy requirements are needed for this specific product. We need to generate once for the life cycle of a product but you continuously evaluate that of course. And one of the key challenges that we face is that there's not often real traceability about these non-functional requirements like security requirements like for example or data privacy requirements that we now identify this application has data privacy issues so we need to make sure that the team backlog because all the product teams work from their backlog that security and risk stories are logged in the product backlog here so that we can basically track and trace, have been designed, have them be tested and is the application a product compliant as an example. And then we starting basically to continuously develop that this is more like the continuous integrations flow as you could see here and you see here some new security components that we need to address in this reference architecture as an example for example, code quality scanning. How do we scan against our code quality policies that could be secure coding standards that we apply and they are tested and validated by our quality code scanning tools. Of course, security testing capabilities like static security testing, dynamic penetration testing, vulnerability scanning and a key element in a digital pipeline is our build repository. It's basically where all the formal builds are stored and certified and typically we have something what is called the software component analysis tool that validates the builds for example from license compliance maybe known vulnerabilities of components that are part of this build because a lot of third party libraries are part of your software build. So here we're trying to secure the CISD pipeline and integrate into the overall product and team backlog, the test management and the security related aspect. And of course when we move in that space of continuous delivery where we continuously deploy something to a test environment and acceptance and production then we need to integrate our deployment capabilities with our build repositories. We do then an additional security capabilities come in place basically part of that deployment value stream like a secrets management where do we store our credential certificates? How do we ensure that maybe the pipeline or deployment tools get privileged access to deploy our server components linked into identity and access management as an example? We have basically the whole cycle of development test and check and change management controls. When something is deployed into an operational environment whether it's test or production hopefully we can automatically update the CMDB that we know what has been deployed where and maybe also validate that through discovery. And then you see some additional security components that we need to implement like security monitoring, it could be log analytics, vulnerability scanning configuration compliance, validate whether the configuration that we deploy is compliant to our policies and stays compliant and point protection as an example of components and there are many more and as you could see after that of course when we detect issues then typically we have a security management component with threat analytics and response that could be automation part of that for automated remediation like security run books that are automated and of course if we cannot fix it directly we need to raise an incident, a security incident response plan, security incident management capability. And as you could see here is that you build up a kind of a framework of IT delivery model with the IT for IT capabilities and what kind of security related capabilities and components do you need and this is we're still working on that with the team to create a security reference architecture but this is more like a high level illustration. The key element of our reference model will also be the data model because data is a key element in our basically part of our digital delivery and aspect of the key element there is the digital product backbone do we have a good understanding of what are the digital products we have like a portfolio of product, who owns those products, what teams are involved but also how does this enable my business value streams, my customer journeys what data does this application of product, consumer use, what interface do we have, what technology services are used and so basically our software bill of material we're talking about here and that and basically that reference model is needed to the right risk assessment understanding the design and compliance. A lot of organizations don't have a single digital product portfolio management capability where we say there's a single place where all the digital products are maintained with the product ownership and it's very crucial for managing this new digital economy because we need to understand where the teams, which pipeline we use, where is the product backlog for each of these products so we can continuously provide traceability and automation there. So that's a key element, I will not zoom into that much detail at this moment but let's take an example of log4j to illustrate a bit this kind of a draft security reference architecture. Now probably you have heard about log4j as a vulnerability that was identified. Now I will use this as an example to some of these capabilities. You've probably heard about it because that's been one of the most significant security vulnerabilities that have been identified the last months and thousands or not 100,000 of applications are affected with 100,000 of servers where this vulnerability was identified and this vulnerability when once this was running on a server that is exposed with let's say a Java application running on it, it was the ability hackers to insert malicious code and take over, execute code on the servers where this application is running. So that's a critical issue here. Now let's see how this currently organizations are using to think about how do I resolve these kind of issues. Basically it's the whole value stream of a vulnerability detected to resolution. Now typically how are these vulnerabilities identified? You see that on the right side. The good thing is that we have a public vulnerability database in the market. So where all these vulnerabilities are identified and basically typically are monitoring tools like a vulnerability scanner or an endpoint protection tools are connected to these vulnerability databases and they get fed immediately. There is a new vulnerability, let's say log4j in this case. Where do I see this running this component in my infrastructure? So this is a very reactive way of course, but still it's very essential because now we identify the vulnerability not known before and we detect that. So then all the alarm bells will go off, there's security threats and alarms but then the key challenge will appear and that is which applications or products and product teams need to fix this because we can I maybe have thousands of servers and some organizations have really 10,000 of servers where this problem is identified. But let's say we have about 1000 servers identified where this log4j is running and I can assure you there's many applications that have this and then we need to identify from a server which product team is managed, what application is running there, which product team and product owner do I need to notify because the only person that can fix it, we go to the product team, they need to rebuild, deploy that fetch into the environment and that's our key challenge, having that single product portfolio, understand the resources, IT resources the software bill of material used by this product and where is the team that is accountable for this specific product and that's basically where we need the feedback loop where we identify something, we identify the product we know the product teams, we send basically to the product backlogs think about JIRA or Azure DevOps they create the stories in the backlog and immediately start working on this to fix this and they will download the latest version for log4j for example, they start to build and integrate there, that could be done in a short period of time and then we have our, basically checks here from a security perspective in this case our build repository that I mentioned before, it is scanned and said yeah it's now fixed, this component is not vulnerable anymore, typically component scanning and testing and then basically based on the green light I can start to deploy the patch into operations, into the different environments and done by the different teams by the way and then we can hopefully resolve this vulnerability for this specific application and then for the other applications as well and this is really a race against time and the challenge that many organizations have is that this is not a fluid end-to-end value stream, we have a lot of components in place in many organizations that could be vulnerability monitoring the security and management system, JIRA and Azure DevOps backlog, deployment tools but what's missing is this end-to-end glue of how this should be organized, so many organizations now realize that this end-to-end value stream for vulnerability to remediation is not optimal, they don't have a good reference architect to look at the data flows and integrations needed, they miss a good product portfolio where we identify what are the products and what resources are used by this product so this is one of the basically issues that I identified that they realize we need to work on a security improvement of our security management framework basically and basically that is what we are aiming for and we provide an infrastructure streamlining and automating these kind of end-to-end security value streams as part of our digital operating model and then I hand over to Altas again very thanks Rob, so we started off in the presentation talking about what are the use cases, what are the personas, how do we look to integrate and move away from the siloed ways that we're operating right now and then Rob has taken us through how we might integrate the various components from a digital delivery standpoint and now when we look at an actual reference architecture, when we dig deeper we find that from a security context even when we take a look at vulnerabilities there are many systems that may contain vulnerability information it could be for example in a threat library somewhere it may be in a GRC or a SIEM somewhere else when we consider where do we have our threats and weaknesses they could be in some kind of a GRC tool or it might be tacit knowledge or it may exist in emails and herein lies the problem we are trying to deliver fast and we're trying to deliver securely but the way that we have our systems set up right now is that they're not fully integrated hence the need for a reference architecture that will bring these systems together allow for bi-directional integration across these systems and not just that but if you take a look for example at a vulnerability and eventually that vulnerability needs to be addressed and you will end up with a control how do we translate from a vulnerability to a control it requires understanding the underlying data model of these aspects and bringing all of these things together so that we are able to now move them in an atomic way across these pipelines and so we still have various folks in security and the digital delivery pipelines addressing their primary problems around delivery or security but we have the underlying backbone that brings all of this stuff together based on what Rob was talking about earlier so this becomes a manifestation now of how we could go in and deliver in a way that provides some level of assurance back to business stakeholders that we have in fact addressed security next slide please so here this slide represents what we are planning to do from a security reference architecture perspective first of all the way that we are approaching this is to align with existing standards and practices so for example IT for IT safe that Rob had mentioned earlier ITIL NIST there's some good work that's been done so we don't want to take away from those efforts we want to build those efforts we also want to go in with the mindset that security is an enabler for the business for the delivery for value creation historically security has been perceived as being a blocker and so there are workarounds that are being created we want to change that and we want to begin to look at a reference architecture that is focused primarily on business value creation the way that we are planning to do this is by using use cases and scenarios so at the beginning of the presentation today we talked about four different personas and there are others in the legal domain in the compliance domain but understanding what their problem space looks like helping to drive out three things in particular the first is a capability model this capability model will enable us now to go and to bring this out in a way that maps these capabilities to value creation secondly we want to go in and take a look at a data and information model how do these things integrate how do we translate from one one piece of data to another piece of data and really looking at it from a risk and security perspective and looking at the relationships and the third is looking at security services reference model so when we consider security we are looking at a services based paradigm where we have tools we have an architecture where the required integrations are coming together to help us achieve what we're looking for now as we go forward with this we will align certainly with other emerging frameworks other standards and our next step is really putting a small group of people together we have this now we are creating this and then we will open it up and allow folks to provide some additional feedback on how we're proceeding with this just round tripping this back again to how we opened the presentation today to the best of our understanding this doesn't really exist today in the industry trying to come up with this kind of a security reference architecture and so it provides a great opportunity for the open group to take this out now and with that I'll ask for the next slide and I believe we're in the Q&A portion at this point so we welcome any questions that we have. Thank you. Thank you very much. Great stuff, really great stuff and for me personally it's great to see an initiative between two different forums of the open group and I think initiatives across forums are going to be a key part of putting together the digital framework that we need across the open group so thank you very much for that it's great to see and just a quick point for those watching if you want to see particularly relevant for the panel later but if you want to see both Rob and Altaz at the same time on the screen if you click the layout button that's on your screen and go to Grid hopefully you'll be able to see that but we'll see that may not work until the slides are removed from that so let's go to the questions so you talked about the personas at the beginning if I can name this one at you first Altaz the question is related to the persona slides is there any persona security context for business execs and business practitioners? Yes, absolutely so when we look at business stakeholders in the very first slide that we put up which described how we are doing security today in many cases the business context the business personas are missing and really when we look at their perspective it is typically focused on risk management it is focused on compliance it is focused on value delivery that is a very important use case in terms of the persona that we need to inject into the security models for far too long security has been perceived as a technical activity in fact it is much broader than that so when we consider the use cases we absolutely intend to inject into that the persona of the business stakeholder along with what their concerns are around revenue generation costs management things like that as well and maybe to highlight as well Steve and Altaz is that it's not just security in the smallest it's also risk and compliance aspects for any digital product even like we talked about in the other presentation about sustainability there could be that our business defines some sustainability goals as well and it needs to be part of the delivery of digital services so it's about compliance policies not regulatory it's very broad but anything that we need from almost like a non-functional perspective needs to be embedded in your digital delivery model is part of this so we still have to find a good name security and risk management those together are we talking about absolutely absolutely so a little bit unfair probably at this stage because I heard you Altaz you've got a group of smart people together the security reference architecture looks like a great development any idea on when you expect to see the first version we're on the hook for I hear you I hear you so we are really striving to have a draft up this quarter don't hold us to that but this is what our intent is we believe that this is urgent need in the industry right now that it behooves us to move very very quickly to try and get something up and again this will not be done in isolation the group that is currently creating a draft will then open it up and others can come in and basically provide additional opportunities so people in the IT forum others can come in and have a look at it as well and provide your comments and your thoughts on this so far in the discussions that I've had even with other communities outside of the open group this is a top priority bringing together standards so that we've got these inbuilt best practices to help us develop a security reference architecture is in fact the right way to move forward and what's happening right now because of this gap that exists there are these bespoke approaches appearing in organizations but it really needs a thought around a standards based approach that helps us ultimately provide the assurance that is going to be necessary back upwards to the business otherwise it will become opinionated and that kind of brings the objectivity of security down so hence that's another sort of area of what's impacting the work that we're doing it's great to hear that that's the approach because that's the approach we always prefer at the open group is to use what's there and work on filling in the gaps or bringing them together kind of a standard as standards approach so very much looking forward to that and of course I won't hold you to it Altez of course not so we do have a couple more questions coming in I'm going to save them for the panel session where we have a bit more time I want to be respectful of people's break time meanwhile gentlemen Altez Robb thank you both very much and if you haven't seen them there were some nice compliments on your presentation coming in in the chat so thank you very much it's been an honor thank you see you later on the panel


I usually start soft, so I'll get louder, inshallah ta'ala. I have to build my confidence a little bit. In my lecture yesterday, we talked about the problems and dangers posed by discursive imperialism, a discourse which, according to Edward Said, attempts to define our terminology and tell our narrative, in this case, as Muslims living in the West. So here's the bottom line. If the West really wants to understand Islam, and when I say the West, I'm not just talking about non-Muslims living in the West. The West in Islam is not an absolute economy. We have to stop being so binary. We are the West. One of my teachers is an American convert.  He said, yes.  Walked out. Since when is Muslim the opposite of American? What is it American? What is a Muslim? If the West really wants to understand this deen, this way of being in the world, then it must, we must, acquaint ourselves. We must acquaint ourselves with our Master Muhammad, sallallahu alaihi wa sallam. If you don't know the Prophet, then you don't know the Islamic tradition. That's the bottom line. If you don't know the Prophet, you don't know the Quran. And anti-Muslim bigots, they know this really well. You can call them Islamophobes, if you like. They know this well. That's why they're constantly trying to assassinate the Prophet's character, sallallahu alaihi wa sallam. It's an age old tactic. Strike the shepherd and the sheep will scatter. And if you knew the Prophet sallallahu alaihi wa sallam, you would know that his message is universal. I'm the master of the children of Adam and I do not boast. He's a messenger of everyone. He said there is nothing in the heavens and the earth that does not know I'm the messenger of God except the rebels from the jinn and inns. And oftentimes this cosmopolitan aspect of his message is misrepresented and termed as Islam's global agenda. This is to create fear. Who threatens you with fear according to the Quran is Satan. That's from Satan. So this rhetoric of Muslims are going to take over the planet. It's going to be planet of the apes. They're secretly planning on usurping power from western nations. It makes for a good mini-series on Fox, I guess. We're talking about this yesterday, the effective media pedagogy. If television is your main source of religious education, then you have a problem and you need to check yourself before you wreck yourself. I promised a brother yesterday I'd quote ice cube again in my talks of I had to do it early, get it out of the way. The Muslims, you know, we're not the ones meeting once a year at the Bohemian Grove, the Bilderberg Hotel. We meet at at risk here and our doors are open. We have nothing to hide. It's complete transparency. We say marhaban ahlan musahlan. You don't need a trust fund. You just need an open heart and an open mind. And if they weren't so loud outside, I'd actually invite the Christians inside and listen, but masha'Allah the man has a voice like a megaphone. I don't know if it's going to be prudent at this juncture. I made a mistake one time of actually approaching one of these hardcore evangelical Christians. It was at a church one time and we were having an interfaith dialogue. And when I walked out, a group of them kind of just ambushed me, right? So I approached one of them and she said, you know, as a woman, so I thought you'd be more reasonable. And so she says, your prophet went into Europe and slaughtered all of the Europeans. Wow. I don't know who you think my prophet is, Napoleon or someone, to know it's very well documented.  And then she proceeded to quote a verse to me from the Quran that ostensibly or apparently advocates violence. So I quoted a verse to her from the Bible, which apparently advocates violence out of context, right? In order to demonstrate her erroneous methodology. So I quoted from Luke chapter 19 verse 27 in which Jesus has reported to us that those enemies that do not accept me as their king, bring them hither and slay them before me, right? And another translation cut their throats in my very presence. And I expected her to say, well, you're not looking at the context, right? And then I would say, of course, that was my point. But she didn't say that. She said, that verse is nowhere in my Bible. But I said, can I see your Bible? And then I just kind of flipped it open. And it was right there. And she closed the book and she looked at me, looked down back at the Bible, looked at me again and said, I know who you are Satan. Sometimes you have to put the fun and fundamentalism. Allah subhanahu wa ta'ala describes the universal aspect of the prophet's message when he says, Well, ma arsanna ka illa rahmatil il'alameen, global mercy, not domination, hearts and minds, not lands and resources, universal in the sense that this tradition recognizes and accepts our distinctiveness with respect to ethnicity, country, culture, language, clan, tribe. It also transcends these designations and distinctions by offering us a unifying spiritual identity called Muslim. And there's no country called Islamistan, right? I assure you, there's no Christendom either, right? I can't tell you how many times I've been asked, are you Islam or are you from Islam? So what is a Muslim, a follower of Muhammad but he himself was a Muslim. So how do we deal with that? The Quran says that the sons of Jacob, the Bani Israel, they were Muslim. The Quran says that the disciples of Isa, were Muslim. This is a transcendental spiritual identity. So here's what I'm saying. There's always going to be a level of hybridity in our identities. We're all hybrids and we should embrace that. Don't fight it. Embrace it. Don't think that you have to put yourself into a box. Am I Afghan or American? Am I Indian or Canadian? Am I Muslim or American? No, we should forsake this black and white binary framework. We find it annoying when people do it to us. Why do we do it to ourselves? Our sisters know about this.  It's very annoying.  Some husband, some father, some brothers forcing you because no one in the right mind would wear a hijab. So they're trying to fit you nicely inside of a box but you're not so easily definable. You're highly nuanced and non-Muslims as well. We have to be careful in our interactions with people. Zayn al-A'bideen said that Allah has hidden His awliya amongst His creation, not in Muslimeen or between al-Muslimeen. In His creation, Allah has hidden or concealed His friends, His awliya. So we have to be very vigilant as to how we interact with people, whether they're Muslim or not. This is common sense. So embrace your hybridity, explore it. There's nothing wrong with being hyphenated. You can be a Muslim hyphen American or a American hyphen Muslim wherever you want to put your emphasis. And what does it mean to give precedence to your faith over your country? What does that entail? Is that a bad thing? I asked five Christian professors at a Christian seminary. I said, which of these two takes precedence in your life? The fact that you're American or the fact that you're Christian, which takes precedence in five out of five times with no hesitation? They said the fact that I'm Christian. It's obvious. And what's wrong with that?  But the soul will endure. The angels in your grave will not ask you whether you're from the east or the west, whether you were a Democrat or Republican, whether you prefer Coke or Pepsi, or whether you were on Team Jacob or Team whatever. I don't even know. I just exposed myself. Some of these designations are important for the dunya, but ultimately they will die with your body. Who is your lord? What is your religion? Who is your prophet? That's it.  I am an Iranian born American Sunni Muslim Hanafi Ash-Ari, whose language is English? Anyone else? I'm usually the only one in the room. I've never had, because I've heard a lot of theories out there. Is he half Jewish? He's occurred. I've never had an identity crisis. You wanted to find me, you could just call me Muslim. So let's look at some of the best of exemplars. The prophet Musa, he was an Israelite from Bani Israel. That was his ethnic distinction. In Exodus chapter six, we are told that he's from the Bani Levi, which means a Levite. That was his tribal distinction. He was born in Mitzrayim or Missa in Egypt. That's his national distinction. He spoke ancient Egyptian and ancient Hebrew. That's his linguistic distinction. His wife was Zipporah, the daughter of a Midianite priest. His children were half Arab. Look at the hybridity. Look at the diversity. But what was his spiritual distinction? His spiritual distinction. What was his transcendental identity? I hope I don't offend anyone with this. But if we can travel back in time, 1400 years before the common era, some 3400 years ago, and we can ask the prophet Musa, I asked him, are you a Jew? He would say, no, I'm a Levite. Because in his day, the word Jew meant a descendant of Yehuda, of Judah, like David was from Judah, but Moses is from Levite. In other words, he would think that I was referring to a tribal distinction, not the name of a faith. If I asked him, are you a practitioner of Judaism? He would not know what I was talking about, because this word Judaism as a concept wasn't coined until the eighth century before the common era after the Assyrians attacked the northern kingdom of Israel in 722, and apparently 10 of the 12 tribes were wiped out. The only two tribes that remained were Benjamin and Judah, and Judah is the older brothers, so they call themselves the Jews. Our contention is that the spiritual identity, the spiritual identity of the prophet Musa, was Muslim, one who peacefully submitted to God. The word Muslim is transcendental. It's anachronistic to call Musa, a Jew. The prophet Isa, Jesus Christ, who was born in Beit Lechem in Judea, the Roman occupation, he was raised in Galilee, Nazareth in northern Palestine. He spoke Syriac, which is the language that the Israelites adopted when they were in captivity in Babylon. He also spoke Hebrew, the language of the synagogue liturgy, and probably spoke Koine Greek, which was the language of the Roman occupiers. So there's a lot of hybridity. Now, obviously, the prophet Jesus wasn't a Christian. The book of Acts tells us that believers in Jesus were first called Christian when they were being expelled from the synagogues in Antioch. It was originally a derogatory term. The earliest Semitic Christians called themselves Nazareans or Evionim, and they considered themselves actually a sect of Judaism. Our contention is that his spiritual identity, the spiritual identity, which is overriding everything, was Muslim. And he says in the Beatitudes, in his mother tongue, and this is obviously from a fourth century translation of the Greek manuscripts called the Peshita, in his mother tongue, he says, Blessed are those who, make peace. If you were to translate that into Hebrew, it would be Baruch HaMashlimim, Blessed are the Mashlimim, which is the exact cognate of the word Muslim in the accusative case. In Judaism, the Nessab or the lineage is taken from the mother. It's matrilineal. And all of the tribes are set for one, a tribe of Levi, and Maryam is Uftaharun. She's a Levite. She's the descendant of Aaron of Harun, Ares Salam, who was the first high priest. The Gospel of Luke also says that she was a Levite. So in that tribe, tribal distinction is taken from the father, only in that tribe. So Issa alaihi salam's tribal distinction would be whatever his father's was, but Issa alaihi salam doesn't have a father. Therefore, Issa alaihi salam, when you think about it, it's not really from Bani Israel. He was a messenger sent to the children of Israel. This is why he's never voted in the Quran, he's saying, Ya qawmi, like every other prophet says, oh my people, because their father is from that people. But Issa alaihi salam says, Ya Bani Israel. So usually when I make this next comment and there's a mixed crowd of Christians and Jews and whatnot, I say, hold on to your hats and your hijabs and your hairpieces. When I tell you that Issa alaihi salam, Jesus Christ, peace be upon him, was essentially a Muslim and in the nation of the prophet, sallallahu alaihi alaihi salam. The prophet, sallallahu alaihi salam, he was from a tribe called Quresh. His clan was Bani Hashem, Arabic, but he was in reality a citizen of the world. And I believe that he advocated what philosophers today call a rooted cosmopolitanism. In other words, to act locally, but think globally, to think of something outside of yourself. Like when he said, ʿUtlubu al-ʿIrm al-Opissin, seek knowledge even to China, sticking outside the box. But many of us will say, you know, I don't want to, I don't want to look weird, right? You know, weird and the kufi and hijab, it just seems weird to me. You know what's weird to me? When I was in junior high, it was a fad, apparently, a trend where you would wear your clothes backwards. You guys remember that? I guess there were some guys, some artists who were doing that, were their clothes backwards. That seems really weird, you know. I don't know if I'm coming or going, I guess. I don't know. Or wearing jeans so tight that you can tell off a quarter in your back pocket as heads or tails. This young brother was, you know, 18, 19 years old. He started growing his beard and he came to me and he was in tears and he said, you know, my friends at school, they made fun of me and so on and so forth.  I'm laughing at you already. You have to put some humor into it. So weird is actually a matter of perspective.  You go to some churches in the Muslim world, you're thinking walking into a musket. You see people standing and bowing and prostrating. They're reciting litanies in Arabic.  And those Christians will say, this is so weird. What are they doing here? What are they talking about? And those are also Christians. So it's not a Muslim Christian thing. It's this postmodern, opulent lifestyle thing. That's weird. The people of faith being weird to the postmodern world is actually a good thing. And I'll end with this. The Prophet Sallallahu alayhi wa sallam said, Inna dina bada'a ghariban. This religion began as something strange, as something weird. And then it'll return to be something strange. Glad tidings to the strangers or glad tidings to the weirdos. So it's loving Allah and his messenger is weird and I don't want to be normal. Sallallahu alayhi wa sallam.


Woo. Hey, John Cristani here. Now, we're doing a special video today. I'm actually doing an interview with a very interesting entrepreneur Who I've known for a number of years JR Fisher Now JR Fisher is You know, he I don't know he owns some internet websites that make millions of dollars a year he's he's been very successful he and You know, he teaches he teaches about what he knows now I mean, he's really cool guy really interesting been through a lot in life and I'm very excited to bring To you bring him to you so you can understand The mentality of what it takes to be successful. So JR. Thanks. Thanks for being on and What do you think of the statement old dogs can't learn new tricks? Thanks for having me on first up John. I really appreciate it. I love your stuff. Um, yeah You know, we were just actually discussing this before we started this interview But you know, what I hear all the time is that I'm too old to learn that I didn't grow up in the technology error Yeah, yes, you did.  Okay, they they they were alive for 20 years And so were you you were there at the same exact time and whatever you do know you learn you can learn anything There's nothing you can't learn. So I think that's kind of a cop out or a reason not to do something So I noticed it took, you know, I You know, I did I did a little looking on your LinkedIn too and I noticed there were 10 years, you know in between you know college and You know where I saw you work at Southern Automotive Group and then another 10 years where you were working your job before you got into the online stuff and Started your internet businesses. So can you can you tell me a little bit about about that journey and how that all led to survival cave foods and Yeah, what what you were doing and maybe did those experiences in form, you know things are yeah Just tell me a little bit about those 20 years not not not where you're at today Sure And first off, you know, I have people say well How did you ever, you know think of starting a survival food company and the answer short answer is I didn't I didn't think of it at all I just hated my boss and I wanted to do something other than what I was doing I was actually managing new car dealerships at the time. I had 16 locations.  I got my kids when they were 12 and eight I raised them 100% by myself and grown now and I wanted to take them on vacations and do things with them And I didn't want to come home at nine o'clock at night You have to go to bed and get up the next day be there seven thirty or eight in the morning And somebody tell me what to and then I really didn't like this guys I didn't like that they limited my income, you know, I wanted to make millions and may you like well that job doesn't pay that It's pay that that's insanity So what I did start doing was starting to market those dealership online and the people that were in charge of the marketing department Didn't like that. They said no, you can't do that. You stick to running the sales departments, you know We don't need you we don't need you to do that So it got me to think and well, maybe I could just sell something of my own online Now the thing I ran into and some of you guys may run into is I didn't have any time to do this And any time because literally I would be at work at seven thirty or eight in the morning I get home at eight or nine at night, you know, I get the kids in bed I'd watch TV for maybe hour and a half two hours. I go to sleep. Let's start the next cycle again I was working six to seven days a week. I was also in the Virginia Beach Rescue Squad as a volunteer was EMT So I was doing that whatever free time I had one day off or whatever and I was sitting there one night And I turned on the TV and I was getting a watch something. I'm like, wait a second. I'm watching TV You know, I'm watching TV. Maybe there is some time, you know I know there's an hour and a half two hours before I go to bed But maybe that's enough time to do something. So I turned off the TV I got on the computer and I tried to learn how to sell stuff online and I started doing here was this This was It's a great question 2009 2009 and I started selling stuff on eBay and all of a sudden that hour and a half would turn it into two hours Now be up to midnight that I'd be up to one in the morning I'd be up at three in the morning and I'd still have to be at work at seven thirty or eight And I would have people say well didn't you get tired? I'm like, yeah I got real tired, but that wasn't the point the point was I was starting to figure out something So that's actually how I got started and that was with cell phone cases of all things 2009 that was like nuclear winter for For a business in America. Yeah. Yeah. Yeah No, you're not don't start a business that that's right.  I mean it looks sounds like you were living in Or maybe you moved to California later, but Tell me about those those years 80s 90s, you know, yeah, it's it's interesting because I Guess because of the successes I've had the college that went to older than the university is contacting me several times The president's come out to California. I've had dinner with him, you know And a matter of fact this year just about a month ago. They wrote an article on me Which will stick it up on the screen there about my survival cave food business And they asked me to be in the monarch their magazine They sent out to all the alumni which I thought was really pretty cool But what happened was, you know, I actually it was selling cars And I've got 79 80 like that and I thought well, I don't want to be a person What kind of life is that that's not good.  I was bartending at a Mexican restaurant And I got a degree The day you had to pick what major you were going to select they had lines for marketing They had lines for finance. They had lines for all these different lines And the shortest line I could find because I had to get to work was finance So I said well, I get in that line because it's short and I can get to my ship So that's how I ended up picking my major was the short line really The short line so what I didn't know and I wasn't good at it was math was a big thing to do with finance I didn't quite put that through my head. So I had to get into calculus and I didn't know any of this because I was terrible student school and So I went year round my last semester. I took 21 credits I went I got my degree in three years in three months But that was not because I was industrious. It was because I didn't have enough money to pay for another semester I just honestly did not And I got out and I looked around and the only jobs that were available were teaching which I taught in a business college I taught accounting and I knew business law So I taught business law and then I bartended at night and I was like, this is terrible and I like this So I saw an ad one day for a finance manager at a car dealership And I had no clue what that was or what that entailed and I was like, well, that's not really selling cars That's, you know, finance manager. I'll be a manager And I took that job and it sucked me back into the car business Um for a good period of time and I ended up. Yeah, we moved out to california Ended up running a mccune chrysler jeep, which was the number one dealership in california number three in the nation So we did really well there, but I I had this thing where I wanted to teach people stuff So in gosh, I'm trying to think what year that was and can you and just f y it seems like you're screen shaking a little bit I don't know if you're like hitting the table. Yeah. Yeah. Yeah. Yeah, just yeah, I won't go on. We'll edit that So, um, I actually left the dealership I was at and I went on the road and I started teaching dealerships how to sell Uh, and I got pretty darn good at that And I did that for about eight or nine years. I traveled the entire united states I did seminars all over all of the place top dealerships in the country and my wife and I decided we were going to split And she did want to take care of the kids. So that was going to be my responsibility And that was when they were 12 and eight years old And at the time getting custody for a guy.  So that's kind of how I got stuck back into that and then from there, you know It was just too many hours and then I started my internet business basically from that point forward Wow, interesting and were there any Do you think now as you said you got You know, and that's that's about 20 years right there. I mean, that's a lot of time How do you how do you feel if if so that you know, your experience is, you know Bar tending selling cars training dealerships all that stuff Like Would you have done things any different way or how or else how do you think that all kind of formed into Where you are now, which is, you know, jr. Fisher, you know running a, you know Millie, you know multi-million dollar internet business. Um You know, yeah, tell me tell me about That you know, I would not change a single thing. You know, I'm remarried now I met my wife at one of the dealerships we bought And a quick funny story about that. She's considerably younger than me. She's 23 years younger than me, but at the time Hey Yeah, and I was I was like 50, you know, so I'm right at 50 and I went into that dealership It's a funny story and my job was to go in there and get rid of all the deadwood It's just start firing people right and left and that's what I was doing. I had my notepad I was going around. I'm like, you're fired. We don't need you anymore. You're fired. We don't need you anymore And I came to the reception desk and jessica was sitting there Now, I didn't know that she actually worked in the office doing the dmb paperwork and all that She was filling in for somebody at lunch. So I didn't bother to look up at And I started listing the things I wanted to her to get done And all I heard was this little tiny voice that said what makes you think I would do any of that for you And I was I looked up and I was like, I think I'm gonna like you We've been together ever since she has an internet business now. She helped me build survival k food. She has a YouTube channel called the furry family coach Jessica Fisher. She has all kinds of courses on dog training She does animal rescue and it was the best thing that ever happened to me Meeting her like that, but At the time you can't see a lot of these things that are going to affect you later on in life and I think Teaching people how to sell cars or many years ago Enables me to teach people how to sell stuff online and motivate them So what to do if you do it right, you know, you can get results But every little step in life is leading you somewhere and you may not be able to see it You may not be able to I couldn't see it, you know But it's going to help you on later on as long as you don't quit as long as you don't quit You know, that's the whole thing as long as you don't quit Um, so I think it all helped me and I wouldn't change the darn thing not a single thing Both my kids are grown now. They're both stable.  Yeah, I wouldn't change any more That's awesome. Yeah, awesome. That's awesome. Um, I love that now was it uh Just wondering how how did uh How did having a you know, obviously, you know, your first relationship broke down how did How did that? How how did how did your relationships affect like how well you did in business? Hmm. That's a good question. I would say did it Oh, yeah. Oh, no. No, it was very difficult if anybody's ever been through divorcing. So yeah, it's not a fun thing at all Um, you know and that dragged on because it had to do with you know, uh, custody and child support and all that kind of stuff um Yeah, I guess I'm going to go back to the saying if it doesn't kill you it's going to make you stronger At the time I thought well, I'm never going to be married again. I'm done with this. I don't want another woman I'm not into any of that. I'm done, you know And I was very bitter at the time and I think you go through these seasons of your life Where you don't you can't see the whole picture and I couldn't at that time Um, and I wasn't looking to date anybody or go anything but nothing I was just taking care of my kids and you know working, uh, and then Opportunities open, you know, like, um, I wasn't supposed to go down and run that dealership That day, you know, I was I was going to leave because I had already kind of started my business on the side And I was just going to leave and when they asked me to do that one thing that I didn't want to do I did it And ended up meeting my wife, you know, that was 10 years ago now. We're still together and we're doing great um, so I think a lot of times you'll see Things that you think are going to be detrimental to you and they're not they're really going to be helpful to you It's it's like if you you don't get that one path and we talked in another interview If your facebook ads account gets shut down and you can never advertise on facebook again You're going to find an opportunity over in youtube. You're going to find another opportunity that's probably far better That's that's kind of like the universe saying well, maybe you don't need that You know, maybe you don't need that and that's kind of how I look at all those things now I couldn't then didn't take some maturity, but now anytime something goes bad I you know, not too long ago a few years ago. We had to go to my warehouse and my wife was going to drive me To the airport dropped me off. Let me go to the warehouse. I'd check on some things And we got outside of our house and I normally park in the street She parked in the driveway and we looked in the driveway and her car was gone And I said we're gonna have to take my car because yours got stolen and she says, how do you know? I said well I'm no brain surgeon, but it's gone And I asked and she says well, it's terrible. I said no it didn't she said what do you even know it isn't? I said something good is going to come out of this something really good and as it turned out The car was stolen. It was it was retrieved, but it was pretty much total They had drugs and guns in it and all this stuff the police found it It was crashed into other cars But the insurance company paid her way more than what the car was worth and we ended up getting a much nicer car And it was all paid for and I said see there It was all it was all a good thing man. Everything's good and you've got to look at it that way, you know every problem How do you maintain like where where does that come from because I feel like especially nowadays like that That attitude that ah, it's going to be all right. Like it's going to work out for the better is I don't feel like that's the attitude of the general population right now I think I feel like the general population is like, you know, or at least the news is pushing down our throats that That nothing's going to work out. Everything's horrible.  Okay I used to fall into the trap of oh my god, this happened to me or and that's a horrible place to be It's a learned thing and it's also a life experience thing where you could look back like, you know The divorce was difficult and all that kind of stuff But I can look back now and go wow, but it got me to here You know, and if it got me to here Then I would have never gotten here otherwise, you know, so Now I look at stuff and when it goes bad, it's like it's just going to lead me to someplace else And like right now with the election and I'm not going to get into politics But everybody's going well if my guy gets in everything's going to be okay My guy gets in there and my life is going to change and your life won't change You know, neither one of them are going to fit your life. This is not going to happen Let's say your guy gets in there and interest rates go way down They go way down for everybody.  You're on an equal playing field with everybody No matter what happens in the world with the exception of what you do What you get up and do every day will have a tremendous effect on your life But those external portions like what you're talking about they just don't matter They really literally do not matter when times are really bad. I mean times are really bad There's always some people that are doing really well, right? And when times are really great and everything's booming There's always some people that are doing very poorly So it doesn't matter. It's what you do every single day and I finally came to that realization and guess what more things work out now Yeah, and I I can totally pair it exactly what you said in the sense that you know, it's it's being able to Be optimistic in the darkest of times. I mean, I've shared many stories on You know my channel about this, but you know, it's It's not quitting until you turn your back. Um, you know, I've been through some really dark times in business and You know maintaining a positive attitude and being able to say hey, there's a light at the end of the tunnel And I'm just going to keep walking forward. Um has helped me out a lot too. So you said you learned it You said you didn't always have that attitude and you learned it Can you tell me a little bit more about how I mean, how did you learn it? I think First off listening to the right people Okay, listen to positive people if somebody's got a negative message I don't care if it's about politics if it's about life if it's about health, whatever it is You need to immediately shut that out. You know, if you've got friends that are like that You need to get ready your friends, you know, that's that's going to be something I'll get some bad comments about But it's a fact You know, if you're hanging out with the wrong people you are never going to be able to get ahead And some of you say well, I've got negative family members. Well, you don't have to spend all your time with them They go, well, I'm married to them. I said, well, maybe you should get rid of them. You know My first wife was a very negative person And it was it was uh an opportunity that I didn't see at the time You know, when we split up it was an opportunity to find somebody really good Now I didn't even go looking for them. They were just there But when you when you're faced with this stuff and I do think it takes life experience Because you've got to be able to look back Or listen to somebody who's been through it There's the other way you don't have to get this in the pain and listen to them And find out that all that stuff that you thought was bad is really an incredible opportunity You just can't see it yet. And I think that's the problem if people can't see it right then You're like, well, I don't see anything positive about this. That's because it's not there yet It'll be there hang in there. It'll be there So tell me a little bit more about, you know, this because you trans it sounds like there was a point There's like a period where you kind of like, you know, you transition from having You know, whatever one circle of friends or acquaintances then you kind of started switching that over to some new folks and um I mean tell me about that process like was it rocky? Was there an explicit like Hey, you're not my friend anymore. Like no, I'm not going to the family reunion or no You know and and and and also like how did you Like get these new people in In your life and where did you find them these new positive or successful motivators? Like how did you bring those in and how did you get the others out and how long was that period and And you know, was it difficult? You know, yeah Tell me a little bit about that and how fast did you see the results of like your new peer group? In in your business It's kind of a gradual process However, I take it back to dating When people want to date they always want to have the perfect make They want to have somebody who's attractive and in shape and intelligent and accomplished And they're like, I just can't seem to find anybody like that So I always say to them. Well look in the mirror. Are you that?  I heard you did this I heard you did this, you know, I'd like to talk to you about things I wouldn't have attracted any of those people if I sat back and didn't do anything People love people who have accomplished things So if you want to be around accomplished people the first step is to accomplish something do something You know, don't just sit back and go. I want to hang out with rich people They don't want to hang out with you until you've done something until you've proven that you're somebody worthy of them Spending their time with because that that process that you're going through where you're saying, well, I want to hang out with successful people They're saying the same thing What did you do? What'd you do? I started doing stuff. I started accomplishing stuff like what like what? You know, well actually in the automotive industry I I did very well there. So, you know people that Delta in the automotive industry were like, I want to talk to this guy because he's like making sales and training people Yeah, yeah, because you know, he gets he gets results I think people like results oriented people to give you an example. My wife Has dog training and she does dog rescue and all that And we were contacted By a group and they were doing a tv show with Caesar Milan And Caesar Milan and his son were traveling around the country. It's called Caesar and son And she had done so much good in that area that he wanted to film a tv show at our house, which he did Now that wouldn't have happened if she hadn't had gone out and rescued animals And we were doing all these things that meant something and helped all these You know, she has bins all over town at all these pet stores Will we collect thousands and thousands of dollars worth of food when we donate them to Dogs Without Borders, which is a Mexican rescue And then they got in contact with that group and then they got in contact with us and we were on tv So it's like What do you put now in the world that people are going to admire? You know, if you're not putting something out in the world that people are going to admire They ain't going to want to hang out with you. There's not but if you are All of a sudden you're going to attract those people. It's just happens And I know that's kind of a technically thing, but it's true You know, I mean, I'm sure you're in the same situation.  I want to talk to you I want to ask you a question Before you achieved all that nobody was calling you Right, they didn't want to talk to john and sit somewhere But now they do because you become who they're looking for and I think that's it Uh, and I think a lot of people don't want to hear that because they're like, oh my god I gotta do work. Yeah. Yeah find somebody that's in shape. Guess what you got to be in the shape That's what they're looking for, right? And if you're not in shape, you're gonna find somebody who's not in shape mentally, physically, financially That's just the way it is.  Did you seek it out? And and did you and when when you came across it or it came across you or whatever? Did you know?  It's like star knee commerce business start a Start a ad agency business sell stuff on amazon. Hey, you know day, you know short Short sell stocks and make millions, you know sell real estate How did you know and and this this survival cave food company? How How did that opportunity come and we can't but the other thing is like we can't take every opportunity like I'd be going nuts.  I'd love you to partner with us Or I'd love to advise advise my company or hey I'd love to pick your brain. I love that one. Oh, that's a good one It's got this horrible like zombie like connotation. Hey, I want to pick your brain. That's like, right Stay away, bro. No Hey, thanks for watching my video. Don't forget to subscribe to my channel and click that little bell right there So you can be notified every time I do a new video Also, click on one of those videos there. Keep watching on my channel


Hello everyone. So I'm Abhinav. I work for SAP in Bangalore. And today I will be presenting a topic of using embedding business rules in the Cloud Foundry IoT applications. In this topic, basically, I will be talking about how to use the business rules in IoT applications. But the concept of using the business rules remains the same, and can be applied to other applications which are not exactly an IoT application. So for this session, I have taken IoT use case as a lead scenario. But it also talks about how you can use the business rules for achieving this. So what is IoT in nutshell? There are multiple devices which are connected to the internet and sending the data. There may be multiple use cases for it. Like you have your refrigerator, which is intelligent, which is sensing how much quantity of food you have, and if something goes down, it sends a request to the supermarket to send it to you. Similarly, in your car, there are multiple sensors which are sensing all the data one by one, and if something is wrong or exceptionally varying from what is supposed to be the standard, it books service for the vehicle and informs the driver when it has to be taken. Similarly, your health devices. So you have the health bands, which is continuously monitoring your health data, and as and when something is wrong, it informs you so that the corrective measures can be taken and appointment with the doctor can be taken. So in the nutshell, IoT or Internet of Things are multiple things which are connected to the cloud and talking to each other to get the result. By 2020, there will be 30 billion devices in the IoT network, so that means there will be 30 billion devices which are connected to the Internet and talking to each other. The main point over here is all the devices are sending all their data to the cloud for processing. So imagine that means 30 billion devices are sensing the data every second, so your heartbeat, your cars, all the parameters are sensed every second, and then it is sent to the cloud for processing. So this means 30 billion devices every second or even lesser than that, sending the data to the cloud for further processing. Now, coming to the problem with this kind of scenario is there's an overloaded cloud. So that means all the data is always reaching to the cloud whether it is required or not required. So maybe to start with, let's take an example of your car. So if you have a car which has the sensors in you, the tires to identify what's the air pressure, and if the air pressure is below a threshold or above a threshold, then it's a critical situation where you need to take an action. But majority of the time, it will be under the range which is required or which is prescribed by the manufacturer. In that case, that data need not be sent to the cloud because it's just a noise which is just adding more and more work for the cloud. Similarly, the simple data enrichment is also happening at the cloud. So what I mean by data enrichment is, let's assume you had a software program which is written to measure the temperature in degrees and degrees. Now you have the sensors which are measuring it in Fahrenheit or Kelvin or some other unit. Then this data will be sent to the cloud and over the cloud this conversion will happen. Now what is happening with all these things happening over the cloud is, the cloud is becoming more and more overloaded with the noise which actually can be filtered out right away in the edge of the device. The second bigger problem with this is your data processing logic is basically hard-coded in the cloud in a code. So that means if you wrote that my temperature will be in degrees centigrade, then that is hard-coded in the cloud. And if your new sensor sends it in a different value, then you need to put a new IT project to convert it or do it. So the business user, though he knows that my new sensor is having the values in some different unit, but he cannot do anything without an IT project to be implemented to do this simple convergence. So the business user actually is not able to react to the changing requirement. So these are the two major problems with this current setup. The cloud is always overloaded and the data processing is hard-coded in the cloud application code. So the possible solution which we have prototyped is basically pushing down the data processing to the device of the edge. So what I mean by this is you push down your data processing to the edge. So edge becomes smart or edge knows like what is basically an event for it which requires an attention which needs to go to the cloud so that the cloud application can take an action for it. And other data which is noise, it just gets filtered out in the edge itself so that the cloud doesn't even know about it. The second thing is basically empowering the business user to react to the changing business. So let's go back to the same example which I was talking about, that you had a program which understands the temperature in degrees and degrees and now your new sensors sense it in a different unit. Now the business user should be able to program it so that automatically it converts the data before it reaches to the cloud in the degrees and degrees. And the business user should be able to do it on his own without any IT thing. So basically if I sum up what we discussed till now is basically two kind of scenarios. One scenario is basically the thinning use case. That means you filter the unnecessary noise at the device or the edge level itself. And second is the enrichment use case. So by filtering use case, the example which I have captured here is only if the room temperature is above 27 degrees centigrade then publish and even to the cloud. Otherwise, don't do anything because it's of no value to us. The second enrichment is basically the data conversion and supplementing the data. So supplementing the data is like adding some status value to it. Like if something is going to the cloud, you just add some status at the edge level itself. And to empower the business user, user to change it is basically we are suggesting to use a business rules. So business rules basically provides the user with capability where a business user can change it. So one of the examples is a decision table where it is written like if the tire number of the tire is equal to one, so that means it's the first tire, it's like your front tire. And the air pressure of the tire is less than 26 or the air pressure of the tire is more than 32 than reason alarm. Otherwise, don't do anything and just drop it. Similarly, if there's a decision table which just does a data conversion, then you can have input and then how the output should look like. And now the business user can just come, change the decision table and then deploy it so that the rules get changed automatically and you don't require an IT intervention. So I will teach you through a demo where I will be showing you both the use cases which we discussed till now. So before going into it, like I would explain how the entire setup looks like. So we have the cloud where this SAP IoT cloud platform service is running. And that is connected to an IoT gateway edge. So gateway edge basically connects to the cloud and this edge has a device, right? So device is like a physical device, so that's like your car and then it has like multiple sensors in it. So sensors are basically a logical device and like device is a physical device.  Now the sensor senses the data and sends it to the gateway and in the gateway itself the rules are running and they filter out or do the data conversion, whatever is required and then only if it is necessary it gets pushed to the cloud. So that means if there's a noise it just gets filtered out at the IoT gateway edge itself. So because in the IoT use cases the performance is a key. So the rule and the rule engine is running in the gateway edge itself and the modeling of the rules is actually in the cloud. So the business just models the rule and he deploys it and it goes and sits in the gateway edge. So what is happening over here is there's an interceptor. So interceptor is something which gets invoked on whenever a data comes from the device and you can write whatever you want your custom logic in the interceptors. So what I have done for the demo is in the interceptor I have written that you call the rules so that it takes that decision and accordingly the data gets pushed to the cloud or not. So I will be just jumping to the demo and this demo basically uses two services one is SAP Cloud Platform Business Rules and SAP Cloud Platform Internet of Things. So for this demo I am using the gateway as the REST gateway. So basically this laptop acts as a gateway and then the devices are sending the data and then this desktop basically acts as a gateway where the rule engine is running and processing the data. In the real world this will be based on either MQTT or Modbus the protocols. So I have already started my gateway and if you see over here I am sending a call to 151. So 151 is basically like a device and then this is a logical node address this is a sensor. So what I am trying to tell is for device 151 for the sensor 2 this is the value and this measure ID tells the type. So now what you can consider it is like car number 151 tire number 2 has a 33 as the pressure of the air tire and this measure ID basically tells whether what's the unit. So 2 is basically for air pressure similarly like that is well that is predefined. So now I'll be calling this and it shows 200 okay. So this is basically the IoT cockpit where I can monitor the values. So if you see for 151 so for this node I have received the data and I will just check the gauge. So it came like zero because we have filtered the data so I will just put it on the real-time measure so as soon as we keep on sending the data it will start appearing over here. So now if the air pressure is something like 39 recent the data ideally it should show me over here the value should get plotted I think there's some problem with the network speed with the network speed over here or something I'll just try to repush the values. Okay so I am seeing for something wrong what I am sending is basically for 151 and what I was checking is 142 let me just recheck it. Okay it's on the top. So if you see the value 40 came and now I will just put it for real-time measures. So the value 40 came over here now I will just change it to something like 38 so if you see this value should get plotted over here and these are the values which are of interest so basically I have defined a rule where I have tell that the value between 28 and 32 is what is normal and everything is basically an alarming situation which need to be reported. So I will be sending 31 over here and if you see the data that got dropped and I just didn't receive anything for it but if I just redo it and put 35 then actually the value gets populated. So if you see over here the value never reached to the cloud because it was not a critical situation and if you would have sent it to the cloud it would have of no use. Now how I have done it is basically I have this air pressure rule so this is basically a cloud environment where the business user can deploy the rule or model the rule so for tire number 2 I have told that less than 26 and more than 32 is only the critical situation let's change it something to 30 so now the business user is able to change the rule and then he deploys it so now the air pressure is even 31 it should actually reach to the cloud so if you see now 31 is reaching earlier it was getting filtered out so what has happened is I have modeled the rule and then deployed it so at that time it came to my my net edge where this rule is getting processed and I am filtering whatever is not relevant to me so now moving to the second scenario where we have the simple data conversion or the enrichment use case so here again I have a device number 251 which has a logical sensor number 1 and it is sending the data it is sending basically that the temperature and the unit which it has so if you see the 400 which is basically the value my type is 1 it defines that it is the temperature in degree centigrade and Fahrenheit basically actually tells what is the unit of this the problem with this is I expected in my cloud that everything will come in degree centigrade but now it is coming in Fahrenheit and this need to be changed so I have already deployed a rule which takes care of converting it so what I would do is I will send the data for device 251 and for if you see the gauge it automatically got converted to 37.78 which is equivalent in degree centigrade and K if I send it in Celsius 41 so basically now I am telling that 41 in degree centigrade and then it should not get converted so if you see the last value is coming as 41 degree centigrade over here so how we have done is I have deployed another rule over here which is called temperature conversion rule and if you see this rule it has basically the unit of the input and here we have written is equal to Fahrenheit and then do the some conversion is like percentage is basically a wild card so it is like if anything then return the same thing so that is why there was no changes for this centigrade now if a business user finds that there is another sensor which is sensing in different unit then what he can do is he can write another the rule over here so is equal to Kelvin and then it becomes value of the input minus 273.15 which is the formula so what happens is if unit I give it as Kelvin then it this rule should get fired so the idea over here is earlier you had to implement an IT project just to do all these things but now the business users is empowered and he can just write his own rules and do it and even if you see over here it just gives you all the possibility of what need to what all you can do and then you just write your rule and even if you read it it is very English like like unit of the input is equal to Kelvin then do something so it gives your very English like structure to express your rules now I would just go and activate or deploy this so at this time it is actually getting deployed to my gateway edge where it is running and now if I send it in Kelvin the value is 300 then I should get I got the value changed to the converted value so so if you see by using the business rules expressing the logic was much easier how the business rules basically if you were wondering how we got the vocabulary or the content is working is basically you have to define your data objects acts like on this acts like vocabulary on which your rule runs so I have just defined that I have input which takes the unit and the value and then I have output which basically gives the how your output will look like and when you invoke the rule basically what you do is you pass these values from the data object which gives you the rule name which runs through it so jumping back to my PPT so this is how the overall architecture looks like so you have the devices which is connected to the gateway edge where your the rules are running which basically does all the filtering or the basic conversion and if we find that it need to it is required to reach to the cloud then only it reaches and in the required format whatever required like all the conversion all those things happened already in the gateway edge and then in the cloud foundry we have the user interfaces which basically can be used by the application user to develop its thing but now the point is application user only gets the data what is relevant to him he doesn't get all the noises from the device which is not required and secondly even on the IoT services like when it reaches the cloud you can use the rule engine to express your logic so that it can be easily changed by the business user without requiring much of the intervention so that's all for the today's talk this is my contact address is not here today but his contact address is also there he works with me is my colleague that's all thank you and I'm open for questions so rule service is a service in cloud foundry and IoT is another service in the cloud foundry so basically that's a service running in cloud foundry in SAP cloud foundry okay so so basically business rules is a separate service so technically you can use it to use it with other IoT other applications also but the thing is currently when I was doing deploy it was running with within the gateway edge so over here you will be making an STTP call to the rule service it will be giving the result and then you can consume it so that's all my question was I understood that part but is it also possible for me to develop a cloud foundry application that use the SAP Rural Engine provided analytic results as a service to the cloud foundry application yes okay thanks because rule service is a separate service from which can be used independently yes on the edge you don't have the cloud foundry thing running right how did the rules what was the ecosystem there on that side on the edge gateway side so edge gateway what we have done is basically when you deploy it I get the rule corresponding rule at a particular file system in my location and then the rule engine reads from that particular thing so rule is basically more like a macro so you have a rule engine and then the whatever you model the rule basically is like XML or a macro which gets downloaded and then my rule engine which is running in the gate edge reads from that particular location so it's just a custom application which you have written on gateway to actually get the yes so gateway if I go back to the thing so gateway provides this interceptors so interceptor gets invoked whenever some data flows in so what I have written is when the code gets called then invoke the whatever is there I mean I have my own gateway so how do I use that so I need to borrow that code from you rule engine and interceptor and rules so basically the idea over here is the rule service is a separate service so you can just invoke it so how it goes is basically I can show it to you so if you see the rule can rules is a service so you have to actually end point and then you can actually give the payload so this is how you can consume the rule engine now because you are using your own gateway so you have to ensure when you trigger this rules so basically if you need to have something like this interceptor at that moment you need to just trigger it as of now no because what I have done is whenever you click a deploy the corresponding thing comes down to my system so I am not making a call because IOT generally need to be a high performance system but yes theoretically you can make a call or as of now but yes you can actually make a call to cloud but only thing is a performance will be a little bit of problem that defeats the purpose of sending a data to the cloud right essentially if you did the service if there are no more questions then thank you


Hey guys, it's Jen from iCreeCrafts. Oh my gosh, I almost missed this deal from Design Bundles. They have their dollar deals going on tomorrow, Wednesday at 11 a.m. I almost missed it, and I would have been so upset with myself if I did, because looking through these, there are a ton of them I'm going to get. I'm almost tempted to just click on the button to get them all. I think there's 44 of them. I was just almost ready just to click it, all for a dollar each. So I would have spent $44, and I'm going to get all these awesome, awesome deals here. So I want to get into making Christmas signs again, and these are really awesome. Oh, I see this one. I have one like this that says candy canes. I absolutely love it, but you know what? For a buck, you can't go wrong. And these alone, these Santa sacks, are so expensive just for the SVG. I would highly recommend even getting this one. You can buy these little bags from Amazon, and you can put it on here with your heat press. Really super easy to do, but I'm really in here to get these. You can make vinyl cutouts with the different colors if you want, or you can make a stencil and use your paint and go that way. Lots of different ways to do that. So definitely want to get that one. It's a dollar, and it normally was six bucks. And laser cutout, I'm not really familiar with that too much, so I'm going to skip through that one. You got these tumblers here. I'm going to be having a friend over that does a ton of work with tumblers, and she's amazing, and she's actually going to help us out actually making these. PS, she doesn't know it yet, but she's coming over here, because I know she watches these. So I'm going to buy this too, and then I'm going to do a couple of videos showing you guys how to do sublimation on tumblers. I have a bunch of them. I haven't even done yet, because I don't even know how to do it. So I'm really excited to have her over. She doesn't know it yet, but she's going to be coming over and helping me. Christmas towels, okay. I know it's early, but who doesn't want to make Christmas towels? Who doesn't want to get Christmas towels? The same thing with this is you can just use your HTV, or you can sub this even. So it is the easiest way to sub these. So I'm definitely going to be getting this one too. So it's a dollar and it was $9. Cannot go wrong on that. My gosh, you guys, seriously, these are such great deals on here. There was also a deal on here. I got to find a little bit later, but it was for my daughter. Oh, here it is. I was just talking about it. So she's really into the tarot cards. So I think I'm going to grab this and I'll make her something, maybe like a picture to put on the wall or like a wooden sign, something that would go in her room. So that would be really cool to have. That was five bucks marked only down to a dollar. Here we go again, farmhouse Christmas stuff. Cannot go wrong with that. You can make so many different things with that. Looking at this, I'm going to grab this because I want to do and show you guys how to make these the easy, easy way. I love making signs and I'm going to show you guys how to do that. All right, I'm sorry. I'm going off topic here, but this one for sure. So I picked up from Amazon. I can always leave the link when I'm doing it. I actually am going to get this. So let's see these. All these files you get for a buck. It's valued at $52. You get 13 designs. Absolutely crazy. But anyways, I bought from Amazon. They are cutting boards and they are thin and they are light. And I'm going to be putting these on them. And I think it's going to look super, super cool. So look at those, which ones you get on there. So going back, let's go back here. I'm going to definitely do that. So stay tuned. I'm going to do a video on that too. I am getting ready. I am getting fired up guys for this Christmas stuff. I can't wait. These are awesome. So I actually purchased something like this for birthdays and for graduation. And they went crazy. So I will do a video on how to show you how to make these two super, super simple and you will make money on these. I guarantee you. So you want to grab those as well. Those are $4 marked down to a dollar. The how crazy. So look at all of these that you get. You have a sticker bundle here. I've never really worked with stickers, but I would love to. So I think I'm going to grab this one and kind of show you guys how to make stickers going off of these. These look really cute. I've actually purchased a lot of stickers from like Temu and Etsy and all those other places, but I want to make my own. So this would be really cool to do. I have the paper to do it. I have the printer. So let's go guys. I'm going to do a video on that as well. So stay tuned. Ornaments. Oh my gosh. I love ornaments. Not really sure how to do that with this. I'd have to look more into it. I think you have to use, I don't know. It says stained glass on the side. So I'm trying to read really quick how you can do this. I don't know if you sub these on or how you make them, but I might actually get that too. That's pretty darn cute. Oh, that would be awesome. My aunt passed away a couple of years ago. So that would be cool to make for her and her memory. But yeah, I think I'm going to grab that one too. Not sure what I'm going to do with it yet, but $800 worth. Heck yeah, let's go. So let's see what else. So here's Farmhouse Halloween ones. Oh yeah, that's just crazy awesome. Look at those. Gotta get it. I'll do videos on all of these. You guys ask for what you want to see and I will definitely create a video on it.  And these are really cool to make. You can buy these bandanas off of Amazon for really, really cheap. And you can sub on this and it's super awesome, super easy to do and you can sell them or give them away. That's what I do at the dog kennel and people love it. So there is definitely something you can do with that. Camping. Okay, I love camping or being outside in the fall time. So this would be really awesome to get. I'll do a video on how to do those two camping sign and blueberry sign. Oh my goodness, how awesome is that? That would be really cool to make a sign that says blueberry or just this and put it in your kitchen. How awesome is that? So I'm gonna grab that. Guys, I'm really thinking that I'm gonna get all 44 of these just for $44 and you get all of these. I'm actually tempted. Come back tomorrow or come back to my site and I'm really tempted. So if you wanna see if I did it, go to Amazon to the community section and I'm gonna say, guys, I did it. I built the bullet if I can talk and I got all 44 of them. I really think that I wanna do that. I do wanna get this one to this laser cutter. I actually do have like an X tool and I've never used it really before. I did one video and went crazy, kinda learning myself how to do it so it'd be kinda neat to use this. So I actually, I think I might do it, guys. I might do it. I might get all 44 of them. Just instead of going in and clicking every single one, say, yeah, I want that one. Even if I don't use it, I'm just wasting a dollar. I'm okay with that because I know I'll use it some other time. So again, hope you guys are watching this video. Like in this video, hit that subscribe button. If you like this video, I have tons and tons of new videos coming. I am ready, I am stoked. I got a brand new studio. I am super excited to get my crafting on so stay tuned to that. Go to the community section where I'm gonna have a whole bunch of stuff posted. Follow me on Facebook where I'm gonna post a whole bunch of stuff and as always, hit that subscribe button if you're not subscribed already as I will have tons of videos coming. You do not wanna miss out. I hope you're having a great day, everyone and I would love to hear it. Go in the community section under where I post mine. Tell me what you got. What you're gonna create with these. These are the super cutest things. Look at these guys, these are so cute. So again, I'm gonna have my friend over and she's gonna teach me and you guys how to create these because I've only done one before and it didn't turn out too well. So I need her expertise advice. So stay tuned guys, happy crafting and I hope to talk to you guys in a future video. Thank you for watching. Make sure you go tomorrow. So I'm gonna scroll up one more time. Grab all your 44 top rated products for a dollar a piece. You cannot go wrong. I almost missed this one. If you wouldn't mind, if you would use my referral code I actually get a kickback. It's a couple cents per one that you purchase but it all adds up for me. I would really appreciate it if you would do that. I will leave the link down below in case you want to and again, as always, happy crafting everyone. See you soon.