Welcome back to the war economy and state podcast. I'm Ryan McMacon. I'm a senior editor with the Mises Institute and Joining me for this podcast is Zachary Yoast and Zachary helped me out last month and he'll be our regular co-host on this where we discuss Issues related more to international affairs foreign policy issues related to the border Strategic issues that have to do with states dealing with other states But of course this does have a domestic policy dimension a lot of the time in terms of funding in terms of what is the relationship? between the taxpayer and The military itself which the taxpayers funding and is also subject to that military's coercive power in Many cases and so in some of these early episodes we want to set up some of the conceptual issues related to this As well as some of the historical American views toward military power and the funding of the military and This time we're going to talk a little bit about early American ideas as and of course how that's relevant today in terms of a standing army and this is this is a distinct and very specific type of military tool Institution and a separate as viewed from classical liberals of the 18th and 19th century separate from the Navy Or from other means of repelling foreign invasion And so we're just going to talk about that a little bit Specifically to how that relates then to the idea of militias in the United States the National Guard And what that has to do with defense military defense in the United States So Zach I wanted to just start us off with a quote here from a story named Richard Cohn and He's got a book called Eagle and Sword the Federalists and the creation of the military establishment in America 1783 to 1802 and so here's a quote from the book He says no principle of government was more widely understood or more completely accepted by the generation of Americans That established the United States than the danger of a standing army in peacetime Because the standing army represented the ultimate in uncontrolled and controllable power Any nation that maintained permanent forces surely risked the overthrow of legitimate government and the introduction of tyranny and Despotism so this I think is a good summary then of what many not all but what many and most certainly George Mason certainly the anti-federalist Viewed with trepidation the idea of establishing a large military establishment in the United States, especially a land-based one And so you can see then how this changed over time and the US moved away from the idea of Decentralized militias and military establishment toward a very centralized 20th century Pentagon focused military establishment that included the National Guard Which is essentially a federalized militia now and so it seems that we're in a much different situation from what the The old laissez-faire liberals of the 18th and 19th century would have actually approved of Robert Nisbitt has this short book called the present age where he just looks at He he tries to answer the question of what if the founders could speed up to the you know, roughly 200 200th anniversary of the Constitution what what would seem most out of place to them? And the first thing he says is the militarism that is rampant in our society and he points out that he has an amusing quote that Oftentimes the Continental Congress seemed much more worried that the Revolutionary War would end and there'd be a standing military Then they were of the British actually winning so I mean It I suspect they would Think things went very wrong if they could see How a bigger part of life militarism is in the United States today? Then core of which is the standing army Well, yeah, and it was in peacetime, right? They they certainly had a concept of the idea of calling forth a militia of raising an army in times of war that assumes some level of consensus among the the people who were taxing the population Because if you could not reach that consensus you wouldn't be able to raise an army at all But clearly if you read the anti-federalist papers And specifically some of the the speeches by Patrick Henry It's clear that the idea was that you had a very much decentralized military that was there just as much to repel the federal government as to repel foreign militaries and in one of his more entertaining speeches Henry gets all super sarcastic and He talks about how he laughs and mocks the idea that We can protect our liberties by assembling the people and having a vote on it to protect our liberties And he's like, yeah, right. Sure. When has that ever worked, right? He's the only he says the only way you can really Protect our liberties is by raising in our own local army loyal to us that can then shoot at the federal government To drive them out of our state and So looking at even when you talk to these Americans nowadays who think of themselves and often self-identify as their very anti federal government and very much in terms of Reducing federal power then they turn right around and praise the federal military establishment to the heights And they want more funding for it and they thank these people for their service Whereas that would have just been a bizarre state of affairs for an American in the 19th century Chandra base of itch has several books where he points out How it's not healthy basically for You know self-government to have like this class of people basically like the military class who are you know, oh You you were in the military. So you have special insight into how American foreign policy should be right Etc. Etc. You know, it's like creating this other class of citizen that is you know supposed to be Better in some sense. I mean, I think a lot of that is often times, you know Lip service to score political points and things like that, but it it's definitely not healthy well, there were many safeguards put in place in The US Constitution and certainly in the old articles of Confederation the better original Constitution in my view that were to keep the feds from having a Outsized amount of power compared to state military power. They were supposed to be some sort of balance there now that was in course involved in ensuring that Civilians maintained ultimate control over the military power You're supposed to have the president who was a civilian explicitly and he was only the commander-in-chief in times of war over the The army in the Navy is the specific phrase to use right decide people walking around mostly conservatives referring to the president of the He's my commander in These commander achieve at the civilian population or something Sparta or something right and so that's kind of odd But there was also this notion that each State governor was the commander-in-chief of the militia and the military forces within his own state And you could see this if you fall if you just watch movies, right say about the Civil War where back then they referred to each regiment as its state from the name of its state of origin, right and One particular movie a famous movie on this is say the movie glory. I think from 1989 Right and it's just notable because they refer to that regiment a million times in the movie Which is the 54th, Massachusetts regiment, right? Well, we don't do that anymore, right? Why don't they refer to these regiments as by their state of origin is because they they don't have a state of origin anymore Like they used to because the the method that had to work was if you had a war situation the president had to basically ask real nicely for the state governments to raise and issue troops and then send them to the federal government to then be under the command of the president but what and that usually worked fine because the US Governors would usually agree with the president in most of these situations So they could the Lincoln who was popular in the north would come out and say hey I need all these troops for the war because these rebels They're doing a horrible thing and so send me your military units So most states signed up on that But not all states did you find in the war of 1812 that in Connecticut for example The governor just simply straight up refused to allow his troops to be used for the purposes that Madison wanted This happened in Kentucky also during the Civil War where in the early years of the war There was a it was unclear who controlled the state if it was going to be Confederates or at least pro-confederate types or pro-union types And so the governor just simply refused to let his troops be used by Lincoln He he didn't want to secede either but also didn't want to participate in putting down the secession movement and it was not really It was not questioned that the state governors could could refuse to send to their troops Now they political pressure was applied.  That was true in both 1812 and in the American Civil War but it was quite well established that State governors could basically veto the calling forth of the militia by the president This was a very important check Then on federal power and so you simply didn't have access to those troops if the governor of the state Didn't want you to do that and that unfortunately then changed throughout the late 19th and into the early 20th century early on they found that you could Work your way around that by by funding partially the state militias yourself and then later They just straight up changed the law to to limit that ability And we can look at that a little bit later in this episode But the but the idea here goes way back really to like so many things that are in the US Bill of Rights because the second amendment makes it clear, right? Although people usually fixate on the second amendment is guaranteeing private gun ownership That's part of it But a big part of it was to ensure that the federal government could not Intervene to prevent state militias from existing from states having their own military powers And that went back then to the English Civil War where under Well, first of all, I mean the Puritans certainly had some in some cases in some situations Opposition then to the royal power in terms of the military and then under the stewards who fancied themselves as absolute monarchs and Failed in that but really really really really wanted to be absolute monarchs James the second especially right you hated Parliament Hated the restraints they put on them. You just wanted easy access to military power at all times So we could just do whatever wars he wanted But there was all this pushback this idea that you should have this middle class locally based gun owning militia of sorts That then would be responsible for maintaining civil order within the country to prevent Uprisings and rebellions and that sort of thing But that those military could not be used by the king for whatever was he wanted to do And that would then limit the king's power So this then was very much in the minds of the Americans in the 18th century who wanted to ensure some sort of Decentralized local control as well. And then you see that carried forth into the 19th century where he had Richard Cobden and The French liberals as well It was all just generally accepted that having a standing army in peacetime was a terrible idea and the American classical liberals Generally accepted that idea as well. It is largely an Anglo-Saxon idea at least in practice of Keeping these armies out of the hands of the king But it's not from what I've been learning from you talking to you a little bit about that It's not strictly an Anglo-Saxon thing Right, and I would say it's not even for the founders. It wasn't only the Anglo-Saxon heritage They're also hugely influenced by their classical education. So they look back to Greece and Rome and whatnot and Until the Roman Republic fell. I mean they also had this sort of I mean you couldn't bring the Legion into Rome you know it there was these kinds of Things and while I don't think the founders were necessarily Explicitly influenced by him. I consider him a good source for interpreting Classical things and I also think he's great in a lot of other ways That's for another episode, but Machiavelli in the prince has several chapters on the military And you might think if you know you haven't read much Machiavelli. Oh, he must you know Strong military to crush everyone and whatnot Machiavelli in chapter 12 Explicitly argues against states employing mercenaries and things like that and argues in favor of basically citizen armies And he goes on for this at length about you know all these historical examples of where you know leaders Relyed on mercenaries who they could oppress their own people with Which is hard to do when your people are your military And he has this great quote Which is that Rome and Sparta for many centuries stood armed and free The Swiss are well armed and completely free Which sort of served as a segue to talk about the Swiss model Which is you know people might answer you know all these points you just brought up and say well that was the past the world So different now we can't you know have We have to have a standing army given the nature of modern warfare yada yada yada yada But I would posit that Switzerland in World War two is the perfect example of how Not having a standing army one It succeeded and two how it has a much better sort of incentive structure for everyone involved the Swiss succeeded in World War two in that they successfully deterred invasion by the Axis powers and The Axis powers drew up plans to invade it was called Operation Tannenbaum and of course there was also the Nazi ideology was in play You know Portion of the Swiss are German. They need to be part of the great German Reich You know, it's it's an aberration that they're not part of us and The Swiss as lots of listeners probably know are already a pretty especially back then decentralized form of government the cantons have a lot of power and The central government does not have tons of power and And this is a sticky issue we can get into later perhaps but the Swiss had conscription And especially as it became clear that World War two was coming down the pike There was a great deal of emphasis within Swiss society at all levels both civil society and the government to Emphasize basically that it is Everyone's job to defend the country Whereas I mean you have you can look at other places in Europe That had standing armies and it was just the armies here to defend the country, you know, what what what should I be bothered with? well, then The army was defeated in a week and the country surrendered Switzerland Because of its decentralized nature, I would argue helped to deter invasion The really great book to read on this is called Target Switzerland by Richard Hallbrook. I'm now a Stephen Hallbrook Who's written lots of books on gun control gun control on the third right gun control in Nazi-occupied France and he's written two books about Switzerland during World War two and a point He emphasizes over and over and over again is that no one Within Swiss society had the authority to surrender The nation of Switzerland the cantons could raise their own military forces and Just before World War two even broke out The Swiss government basically declared no one has the authority to surrender if you hear Switzerland surrendered, you know that's enemy propaganda and it's everyone's job to fight to the death and The it sort of is amusing almost to the degree to which the Swiss were sort of psychotic about their national defense and I think that's a trade-off that People have to think about some when it comes to having a standing army versus people defending themselves If you have a standing army, it's it's someone else's problem to do all this Whereas the Swiss it was hugely inconvenient to at one point about a quarter of the population was officially mobilized, I mean, can you imagine how disrupted life would be if you know One out of every four people on the street was officially in the military, but even beyond that the Swiss Made provisions for everyone to fight If you're familiar with you know, the Geneva Convention and this is an issue in Ukraine right now People if people are not uniform then they can just they don't they're not protected by the Geneva Convention So from the beginning of the war the Swiss instituted they basically issued armbands to the entire population Literally even women and children. So they had these armbands on they could legally fight it was very costly to Defend the country like this, but in the end it worked basically so and we could I think there's a lot of lessons that could be drawn from Their experience to numerous other examples both in World War two and after well, and of course in the United States You're not in that situation, right? It's a perilous Position to be Switzerland when you're next to the Reich Or next to just large states, right the French state one of the largest states in European history very powerful They have you know, the Italians have not historically been a big problem for neighbors But the Germans and the French have Is at least going back to Napoleon but boy go back to the 30 years war, right? I mean Switzerland didn't really exist in the way it does now, but big problem being right there in the middle of things and You could say same thing about of course the low countries I suppose but they never really developed those institutions the way the Swiss did and yeah The Swiss have been more successful at repelling invasion because of that and partly because of geography, right if you're a flat Right. I'll jump Poland would have difficulty pulling off the Swiss strategy But but they would have to have a similar level of as you say psychosis in Right. Yes. I mean literally multiple times the sort of the general which was like this position that was created His name was a Henry Gleason. I don't know if that's pronounced right He was French speaking Swiss Issued standing orders basically that everyone was to fight to the last man like Where I mean he criticized basically like the collapse of the the French army At the beginning of the war and all that because he's basically like if they'd fought, you know They might have won and even it's on we know from Documents that the Germans military did not believe it could have conquered Czechoslovakia But they had the president of either I can't remember exactly their structure of government It was odd, but they basically had the president of the Czech part of Czechoslovakia in Germany And we're basically like we're taking this to Dayton land and you better phone home and tell him it's happening You know, there's no person in Switzerland that could be you know Coerced at gunpoint to surrendering anything So it it's sort of I think it would the Swiss are a good example of The idea which I'd say the founders believed for America certainly that you know people were only free if they Maintained their freedom themselves and we have sort of farmed that out to our standing army, which as I think you were leading to the United States is perfectly situated to not have a standing army in that our strategic position, you know Mexico or Canada or Brazil are not going to ever invade us and You'd have to cross the Atlantic or Pacific oceans to get here Our standing army is really for intervening around the world, right? That's an important Note to make right is the standing army for North America for the United States does not serve a defensive purpose Normally when someone brings up how you need a standing army to quote-unquote defend America They're usually talking in some fantasy land stuff about how the Chinese are gonna send a flotilla Across the many thousands of miles of Pacific Ocean To invade California and the best they can come up with is oh the Japanese Occupied some of the Aleutian Islands Yeah, boy, and I really struck at the heart of the American mainland those Aleutian Islands, which were inhabited by like a weather team Meteorologist and the reality of course right is as we've discussed on the last episode right just that 90 mile trek across the Taiwan Strait for invasion purposes would be an unprecedented logistical feat So the idea of sending China to invade North America is just so far beyond the realities And so what does that mean then it means the standing army isn't key to defense what it means is the Navy Probably a very important factor It means the nuclear arsenal is a very important factor, but that's not what we're talking about when we're stuck talking about the standing army The standing army also as the as the classical liberals the old anti-fetalists understood is it's unlike the Navy Or any sort of like small force that you might have had right because there always was like a small standing army of About 1,500 Soldiers and officers that the US has you ever want to read something funny read the account of how Washington was so obsessed with ending polygamy in Utah that they sent an army out to Salt Lake City to teach those polygamous lesson and President Buchanan sent like basically the whole US military which was like 1,500 guys and And of course there were then some local skirmishes and so but nowhere near sufficient to occupy Utah as they I guess they were trying to do or at least scare the bejesus out of the the Mormons out there But that was the idea is that it would be too weak to send someone there So notwithstanding crazy people like Eric Swalwell who made some comment about I will enforce gun control in America because we have nuclear arms Sane people know that using nuclear arms to put down local insurgencies is crazy It doesn't accomplish any of your strategic goals, right? So if you have suicidal crazy people in charge of your government, then yeah, those nukes might be used for local counterinsurgency But the in reality, however, it doesn't serve the purpose that a standing army does where you can actually occupy US cities Institute martial law send in the troops to ensure people follow the rules That's what a federal standing army can accomplish and that's why the old liberals really hated the idea and why they wanted something That would be locally controlled by Some sort of local team whether it be the local governor or some sort of local council and so we're not talking about Just that could be for another episode. We're gonna talk about maybe you could abolish most of your all your military capability But we're taking our super conservative position here of just saying no standing army That's not saying anything about the existence of of a Navy, which by the way has its own huge massive Air force of its own so you wouldn't even need a separate air force the Navy in the air for and had sewn air force go together That's its own thing so you can do power Projection through that and and just to go back to what you were saying about you know, the central government can use the standing military it's sort of an issue of trust like not having a standing army is an issue of sort of trust in that you know Like you had me on radio Rothbard to talk about my like policy work related to Taiwan You know Taiwan would is well situated to adopt the Swiss strategy But a huge crucial difference is that Taiwan basically doesn't allow like any civilian gun ownership the Swiss strategy works for the Swiss because Shooting was like the national pastime like that the nap basically like the national gun club Was like one of the like leading institutions during World War two in terms of like, you know keeping morale up and basically like urging, you know You know school children to target practice so they could shoot paratroopers if if the Germans attacked it's just sort of Yeah, I mean we can even look at Ukraine After they were invaded they're like civilians can own firearms Well, okay, you know, that's Not very helpful at that point, you know, it's sort of a cultural It's sort of like the argument that freedom requires some cultural Ingredients one of those is the willingness to maintain that freedom if people are too lazy I mean is what it might boil down to then it's Not gonna be around so I think lots of cultural components as well which We could talk about it in other issues how militarism has under undermined all of American society the family morals everything you could could make the argument stems from Deciding to keep a standing army basically after World War one Well, and let's talk a little bit how we got to that point then Before we go just mentioning that the people run Ukraine also got rid of their nuclear arsenal Which is probably their number one defense against any sort of Russian occupation and so these are the same geniuses who prevented private gun ownership for 25 years after independence Actually more like 30 years really but yeah looking looking at the United States That really started to come to an end in 1903 Because I do know that there's a lot of vague information out there about how well the the National Guard is the militia, right? When when the second member refers to a militia they mean the National Guard But they very much do not mean that when when they're talking about these institutions because you can see in the writings of Some of these these early Americans that they did have a concept of the National Guard and there's there's a nice article by David Yasky in the Michigan Law Journal and He talks about he well here's a quote from him He says the founders did have a concept that approximates today's National Guard, but it was a concept. They disapproved This is the select militia quote unquote Especially trained part of the citizenry to the founders a select militia was a little better than an army The Philadelphia Convention explicitly rejected a proposal to create a select militia for the federal government as did the third Congress The Constitution's proponents moreover repeatedly denied anti-fetalist charges that Congress's power to provide for training the militia Would lead to creation of a select militia. So there was a great fear even that if you had this nominally Controlled group this the state nominally controlled by the states that They were still beholden too much and were professional agents of the central government And so they they they opposed the idea of the National Guard, which was invented with the militia act in 1903 so as lay it even after the Civil War when there was a whole lot of centralization going on At the federal level you still had very much the concept of the unorganized militia and The the official militia which might be called forth and in one of my articles here on this topic I look at I actually do a survey of state Constitutions over the years that had the explicit language in it that the militia that is people whose Private gun ownership could not be denied was basically the entire male population about age 18 to 40 or so and that was common through a lot of state Constitutions and it was assumed then that those people would be then brought under the state government to maintain civil order But that would be totally independent then of the federal government unless The state government approved the nationalization of that unit and it would all it was also assumed then because of these fears of federally controlled select militia that the training would take place under the auspices of the state government as well But what happened over time is the federal government more and more began to emphasize that the state Governments supposedly were not did not have a sufficient level of readiness Always of course defined by the federal government itself as to are you sufficiently ready for military needs? What what this was was never quite clear as if the Mexicans were going to invade or something like that Which was never really plausible and it was in the in the the Spanish American war that you started to get then movements toward using these These national or the state level groups For these wars of imperialism essentially and then by 1903 with the militia act they decided okay Well, we are gonna start funding These state units ourselves, we're gonna ensure that you meet certain standards And basically we're gonna create the National Guard and then over the 20s and 30s and 40s Did this started to become more and more really a subdivision of the federal government and Then this started to chip away also with the idea that state governments could veto Federal mobilization orders and then that finally came to an head then during the Vietnam War Where if you know more clever people they were joining the state National Guard in order to avoid being shipped off to Vietnam and because the law at the time was that State National Guards could not be used for foreign mobilizations that that was something specific to the federal professional military and A lot of state governors were just straight up or refusing to send their own troops And then through some court battles that was overturned and through the Montgomery amendment, which was an anti communist paranoia thing that occurred During the 80s where we don't want any of these state governments Many of whom are too much commie sympathizers to be able to veto Mobilization to Central America was really what a lot of the fight was they wanted to send these state guard people to Central America to train local terrorists kill squads and Central America and So they ended that so now essentially state governments have almost no ability whatsoever to keep their troops From federal deployments and you hear now about how you've got people in the in the National Guard are like well I'm I'm shipping out. I'm being deployed to where oh to Afghanistan to Indonesia for training They just ship them all over the globe in places that obviously have nothing to do with actual defense of United States territory and that's just now There were members of the Florida National Guard in Ukraine Training the Ukrainian military until like a few weeks before the invasion happened and it just kind of It's like I see ads for the National Guard all the time, you know on TV and whatnot I mean here in Pittsburgh at actually like at the Pittsburgh Airport are two wings of the Pennsylvania Air National Guard so I see that stuff all the time and you know all the all the Advertisements and everything are like help your community when there's a disaster, you know, you know So, you know, it's it's sort of very local centric At least in my impression and then it's like actually we're sending you to Iraq You know, which has nothing to do with your town in the middle of Pennsylvania Yeah, they very much appeal to the idea of local patriotism and then but really what it's about is you're basically a Reserve force for the professional military to fill gaps in their needs for conquering foreign countries and That's always been a very important role of a standing military is its offensive abilities, right? Is that you would have never had troops to occupy Iraq? Or if if get at Afghanistan if you didn't have these National Guard units that you could call up if they if the US only had a Navy and a small specific force In as imagined in the 19th century There would have been no problem with defense ever But it would have been way more difficult than to just start wars and send men off to actually occupy Foreign countries, but you're right. They try to recruit you so you can pay for college and then they send you off to occupy foreign countries And it I think we can look back if I'm remembering correctly during the war of 1812 It was a huge issue where the federal government tried to invade Canada and all the you know Militias from like upstate New York and New England would not would not go across the border Basically, that's right, you know Yeah, some states refused to send troops outside of their own state and then some State militias refused to cross any national borders because they viewed themselves as defensive force So boy how different things have become and now you've seen the so has just kind of wrap up with attempts to really sort of recapture some of that idea From an earlier age as you do now see these defend the guard bits of legislation at the state level Where Pat McGee and I think kind of set that off in West Virginia when he is I believe an Air Force veteran The idea of look you can't use National Guard troops unless you formally declare war and I would have liked to see something even stronger was you can't send these people Outside the United States at all which has been tried in the past and has unfortunately failed But that of course would be something much more in line with 19th century ideas of a militia and a National Guard But when when McGee and tried that and you hear this and this was also tried in the 80s where there was some resistance to Nationalizing the National Guard for stuff that had nothing to do with the state's business Boy, the pushback from the Pentagon was just enormous They immediately show up and start threatening you with like we're gonna pull all of our bases out of your state And there's gonna spike your unemployment rate and we're gonna just trash you in the national media and why do you hate America and We're gonna tank your economy we're gonna do everything we can to ruin you If you don't take orders from the Pentagon, even though this is supposedly ostensibly a state defense force and That's certainly according to McGee and he received all those threats That was used in Ohio in when they last tried to do that and a lot of it now stems From and boy were they anti-federalists were right It stems from the federal funding that comes down and is used to train These troops so it's with so much else that that where the federal government bribes you whether it's on drunk driving laws and then federal speed limits Education policy they can use all this stuff and they use it very much with military policy then to bribe the state governments that then just take orders from the Pentagon because then You'll have to use your own state budgets to fund your own state militia Which of course they they don't even really want you to do of course because then you wouldn't You wouldn't fit there arbitrarily set definitions of readiness and such readiness which in their minds is readiness Where you need to be able to invade foreign countries. It's not really related to our actual local defense And I would say this is an opportunity for sort of classical liberal slash libertarian minded you know scholars, you know if you're like in grad school or thinking about grad school like like We're talking at a very sort of abstract level here And I'm certainly not expecting the standing army to be abolished Anytime soon, but it it definitely won't be abolished unless people have done some work laying out How that could work like specifically beyond just the abstract so, you know What comes to my mind is the federal government's terrible Financial state, you know, maybe in a few decades. Who knows there'll be some willingness to maybe we should you know reduce The federal defense budget and you know farm this out to the states I mean that's sort of wishful thinking, but it's definitely wishful thinking unless that proposal things like that are out there in some sort of Fleshed out form that you know the policy people who work for the senators and whatnot can be aware of I'd say so I just encourage people, you know, this is an area that You know, not many people write about so, you know, you could own the niche and it would be quite good Hopefully down the road But it could at least potentially bear some fruit Well, we better wrap up with that then for this episode of war economy and state Thank you for joining us. We'll be back next month with another episode and we'll see you next time


What's up everybody? Welcome back to the channel. It's time to give away some posters We got the Chelsea Denofa and the Vaan getting junior autograph posters to give away We're gonna start by giving away this Chelsea Denofa autograph poster and the winner of the autographed Chelsea Denofa poster is Ricardo Sin Sistano I'm sorry I butchered that last name comment of sick game. It's a challenge But overall it looks sick hope to see more content on the of need for speed You definitely will see more need for speed payback content Coming here in the new year. So congratulations Ricardo. You did win that autograph Chelsea Denofa poster So now we're gonna reset this get ready for the Vaan getting junior poster. All right, so we got it reset We're giving away this Vaan getting junior autograph poster. We got everything all set up in the computer We're gonna hit start in the winner of the autographed Vaan getting junior poster is poop masters But Raleigh Raleigh that is me or my Congratulations, you did win the autographs Vaan getting junior poster. We'll be getting in touch with you So if you guys have won a poster, we got two giveaways left. We got Christmas Eve Giveaway as well as the final Christmas giveaway So make sure you guys check back to the channel tomorrow for the Christmas Eve giveaway as well as we do have one more giveaway going out Later as well so We have a few posters left to give so make sure you guys comment on the videos down below and Until tomorrow guys. We'll see you later


I was born in Honolulu, Hawaii and I grew up there and I didn't move to the mainland United States until I went to grad school. I did have the experience of growing up and feeling singled out just because of my race for things that I felt weren't my fault but were rather just who I was as a white person in this small town. I didn't really realize until I got to graduate school and started studying education philosophy that there were also a number of privileges that went with being a white person because as a child you know I certainly felt sometimes afraid or angry because I felt discriminated against by other people and I also growing up in Hawaii was so fortunate to be exposed to so many other cultures. It was interesting coming here because some of the body language and the rules and things about social interactions are not the same as they are in Hawaii. So I had to really learn that when I wanted things from students it wasn't enough to just be silent. Where I came from that was enough for people to know that you were not happy with them. You know and when you raised your hand in class you would be thought of as a brash person you know and I was taught that growing up and here I had to learn that I really need to be a lot more direct with people when I wanted something from them and to make it okay in my classes for them to speak up even though it's more the norm here there are still students that feel shy just like I did because of some sort of feedback they're getting in their culture. I went to graduate school I took a class on teaching elementary music because it sounded interesting you know and I liked it and so I thought okay I'm gonna take another music education course and the only thing that they fit my schedule in the next quarter was classroom management and I just almost fell over backwards when I realized that there was this whole science to teaching you know manipulating people I suppose but you know through setting up objectives and assessments and then rewards that I could make students happier it wasn't just about me being positive it was about me being clear and making them feel like struggling with something was worth it because and supporting them through that through the way that I was managing my class and designing my curriculum and so right after that I decided to get a teaching certificate because I just wanted to know more and more and more and so I ended up doing a post-bac in music education and then one in social studies because I have my interest in diversity and history and just psychology why on earth people behave the way they do which has been really useful in directing the opera anyway my favorite class in that whole thing besides management and educational psychology was something in leadership and policy studies about teaching diverse learners and we read a lot of things about that really made me understand that not everyone is me in disguise you know people are really coming from their own place and you need to honor that because that class was so interesting I took a number of other grad classes on multicultural education and special education I have an uncle who's developmentally delayed that I grew up with and that was an issue that was near and dear to my heart and it I think in taking that class I realized that you know with any given disability everybody has it to some degree whatever it is attention deficit disorder or anxiety whatever it might be it's just not to a debilitating level you know and it's just when it gets to a point where it's interfering with somebody's ability to do meet their goals that it could be considered as a disability but it shouldn't be stigmatized because those qualities are really present in everyone I've always felt that if I could draw a connection between the richness that is out there in research and theory about how learning works to everything we know in the field of how the voice works and connecting deeply to song and melody literature that it would be a really wonderful thing


Hello, everyone, and thanks for joining us today. My name is Ryan Minook. I'm a Solutions Consultant here at FondMaker, and I'm really excited to be your host for today's FondMaker Security Web Seminar. Joining me today is Rosemary Teejee, a Consulting Engineer at FondMaker, who'll present best practices and tips about FondMaker Security. But before we get started, let's cover a few brief housekeeping notes. For the best experience, it is strongly recommended that you participate in this Web Seminar with at least a broadband connection. If you have any problems or require online assistance at any time, please contact Citrix Technical Support at<PHONE_NUMBER>. Now, throughout today's presentation, you will have the opportunity to type in and ask questions. So let's talk briefly about how to do that. Go to the Control Panel, click on the Question section, enter your question, and click Send. And we'll try to cover as many questions as time allows at the end of our presentation. The two final items before we begin. FondMaker has recently released the FondMaker Training Series Basics Guide, which is a great follow-up resource to our topic today, as it details the mechanics of setting up security within your database files. And you can download it for free on FondMaker's website, or you can get it as a free download on iBooks. You also want to download a copy of the FondMaker Security Guide available for free to members of FondMaker's TechNet program. Now, if you don't have a TechNet account, you can sign up at no cost on FondMaker's website or access TechNet directly by going to the URL listed on your screen. And while the FondMaker Training Series Basics Guide covers security within your database file, this security guide details how to secure your solution across the FondMaker platform. It's now my pleasure to hand over the presentation to Rosemary. Thank you, Ryan. And welcome again, everybody. And thank you for coming to our security webinar today. So my agenda for today is to talk, first of all, about kind of the broad security environment and talk a little bit about why security matters, and then dive into some key security concepts that are important for FileMaker and any other computer system security you may be thinking about. And I'll do a deep dive on how to secure a FileMaker Pro solution, and then wrap up by showing how FileMaker Server can be part of the broader environment in the FileMaker platform to help you improve the security of your solutions even more. First, let's talk about why security matters. So I have some numbers, 740, 89, and 76. And these are kind of big numbers. They're a little scary. And let me go into a little more detail on these. A recent study found that there were 740 million data records compromised last year. 89% of those breaches were fully preventable. And 76% of those were caused by weak or compromised passwords. And that's from the Data Protection and Breach Readiness Guide published by the Online Trust Alliance. And you can download the full report from the Online Trust Alliance's website. And it's kind of shocking and frightening reading. In addition, why we talk about security with our customers is because many work in regulated environments of some sort. There's an alphabet soup of acronyms that our customers ask us about very frequently. And if your system contains medical records that are governed by the Health Insurance Portability and Accountability Act, or HIPAA, or student data, which is governed by the Family Educational Rights and Privacy Act, or FERPA, you are probably already aware of the compliance requirements and what you need to do in your FileMaker systems to build those systems as a compliance system. But if your systems contain more general PII or personally identifying information, or PCI, payment card information, you're at risk if you do not follow the requirements and best practices for handling that type of data. And that data is generally governed by industry regulations like PCI. And specifically in the case of PCI, if you suffer a breach because you're out of compliance, you may lose the ability to accept credit cards, face hefty fines, and be liable for your customer's losses. So it's very important if you're handling any type of customer data, specifically anything that is regulated or extrasensitive, that you comply with the best practices and any regulations in your industry. Next, let's move on to some key security concepts. The first broad concept is building a system where the right people have the right access to do their jobs and no more. And around that, there are two key concepts called identity and access management. In the FileMaker world, identity is the accounts and passwords that we set up in a FileMaker database. And they define who has access to a solution. And just a key point about FileMaker passwords is that we cannot recover them for you if you forget them or lose them. Those passwords are stored as a one-way hash, or they are encrypted and stored as part of your database file, and then they're never, ever decrypted. When a user goes to log into a FileMaker database, the password that they enter at the dialogue is also hashed, and then the two hashes are compared. So the passwords are encrypted, as I said, and never again decrypted. And access management in FileMaker is the privilege sets that we set up in our databases. And those define, at a very granular level, what a user can see and do in the database. And the third FileMaker concept is the concept of the extended privileges. And those delineate or describe the methods by which a user can access data in the database. Second key concept or group of concepts is the concept that unauthorized people have no access at all to solutions. And there's some things you can do to limit that unauthorized access to your FileMaker solutions. As I said earlier, most attacks result from compromised or stolen credentials. In fact, the attackers in last year's target breach use stolen credentials from one of Target's third-party vendors in a small region of the country to access their entire payment system. So very important to educate yourself and your users to use strong passwords and change them regularly. A strong password is at least a character's long and uses a mix of uppercase and lowercase letters, numbers, and symbols. And then don't use your password from any different systems and don't reuse passwords. And finally, don't write down your credentials on post-it notes and then stick that post-it on your monitor or under your keyboard or in your pencil drawer. A lot of security breaches also come through some form of social engineering. And someone just breaking into your office building and walking around can probably very quickly gain access to pretty sensitive systems simply by finding those post-its with passwords written on them. The next thing you can do to limit unauthorized people from accessing your data is to encrypt your data, both when it travels over the wire using SSL encryption, which is encryption between FileMaker Server and the clients that are accessing FileMaker Server, and also by using encryption at rest or taking your whole database file and encrypting it with AES 256-bit encryption. And once you turn on that encryption at rest, the database is encrypted wherever it is. If it's on disk, if it's on an iPad, if it's on a thumb drive, or if it's on a backup tape, and that will limit the risk of someone stealing a laptop or stealing a backup tape and then getting access to your sensitive data. And finally, just want to remind you that physical security is as important as digital security. You want to maintain control over things like laptops and iPads and use things like mobile device management and the iOS data protection by turning on a passcode on iOS devices to limit the risk of risk from those things being stolen. It's also really important to put your server in a locked room and limit access to that room. And finally, maintain control over things like backup media and thumb drives so that if those fall into the wrong hands or to limit the risk of those falling into the wrong hands. So now to take stock, we've talked a little bit about why security matters and some key concepts. So now I'm going to demonstrate and discuss how to secure your FileMaker solutions. There's really four things to think about when you secure a specific FileMaker database or group of databases. You want to turn off the auto login in FileMaker. You want to change that full access or admin account name and password. Then you'll add privileged sets and additional accounts for all the different users who will be using your system. And finally, you want to take the steps to ensure the integrity and security of the database file or files themselves. So first, we'll turn off auto login. And as you may know, as you've probably noticed when you create a brand new FileMaker database either from scratch or by using a starter solution, FileMaker automatically creates a full access account and then sets up the database to auto login so that you don't have to enter any credentials when you launch that database. So to turn off auto login, you're going to go to the file options and then just uncheck that checkbox that says login using a specific account and password. Takes about five seconds and then whenever someone opens that database they will be prompted for credentials. The next thing you want to do is secure that full access account. Secure the admin account because anyone who's used FileMaker and created databases probably knows that the default account is admin with no password. So even if you've turned on requiring a login they are going to first guess, well maybe something simple like admin for the account name and password for the password. And the more you can do to obscure those two things the better your security will be. You know so again to do that you're going to go into manage security and then double click the admin account to bring up the edit box for it and then simply add a password or to be better you want to change that account name away from admin to something else. So let's go into FileMaker and do those two things with an example database. So for this example database I'm using the equipment rental solution that you would build if you work through all the exercises in the FileMaker training series basics. So here we are, this is a solution for equipment rentals we have customers and then we have the assets that those customers rent in this database. So to start off I'm going to go into file options and uncheck login using. So now if someone tries to open this database they will be immediately prompted for credentials. Next thing I'm going to do is manage security and secure the admin account. I'm going to edit that account, change the name to be Rosemary and put in a password. Now whenever anyone tries to use this database they need to put in those full access credentials for now because that's the only account in the database. So if I close and then reopen this database I'm prompted for a password and there I am now I'm logged into that database. So now that we've secured the file a little bit let's talk about privilege sets. So privilege sets are the control how a user what a user can do once they're authenticated and have access to the database. So to edit them it's again manage security and then you click on the privilege sets tab and if you're creating or editing a privilege set there's several areas of the edit privilege set dialogue. The first is a name. In general the name is going to be a group of users. You know in our example we have two groups of users that will be using this system. One is technicians and the other is sales people. Our requirements state that technicians can edit asset data but only view customer data. They can't delete records in either table and they don't have any design capabilities in the database. And our sales team can view and edit some customer data. They can see all customers but they can only edit those customers that they are the salesperson for. So those records that they own in some concept. And for assets they can see all the assets but they cannot edit or delete assets. So to set up those privilege privileges you start in the data access and design category. And for records you probably are gonna set custom privileges so that you have control at the table record in field level of who can do what in the database. This is also where you set up the broad access to layouts and value lists and scripts. The next area is the other privileges and here this is things like printing and exporting of data. Printing also includes the Save as PDF function and exporting includes Save as Excel, copying all records to the clipboard, using this file as an import source for another database and several other functions. Other things that are important to note in the other privileges area is the checkbox to disconnect users from server when idle and allowing users to modify their password. And then you can use this privilege set dialogue to set a few simple password requirements like a change frequency and a minimum length. The last area of the edit privilege set dialogue is the extended privileges. And as I said earlier, extended privileges determine data access methods. Can this group of users access the database via the file maker network? So from FileMaker Pro and FileMaker Go. Can they access via FileMaker WebDirect? And finally that require reauthentication after the specified minutes extended privilege refers to getting back into a FileMaker database after hibernation when the database is being opened using FileMaker Go. And what you can do is set a specific timeout for how long that database is hibernated and if the hibernation is longer than that timeout, the user is then required to reauthenticate. So if you have a 10 minute timeout and you're logged in on your iPhone and you take a 15 minute phone call, when you come back into FileMaker, you'll have to reenter your credentials. If it's only five minutes, you will not have to reenter those credentials. You can also use custom extended privileges to enforce additional business rules in your system and simplify your scripting. Some examples are setting an extended privilege to allow users to run reports or not at certain times of the month or quarter or you can use them to delegate approval authority if certain users are on vacation. So once you've got all your privilege sets to find in your database, the next thing you'll do is add accounts for every single user. You don't wanna set up a single group account with a single password for a group of users. Instead, you want to set up an individual account for each user and then assign each user to a privilege set. So let's go do those two things. Again, I'm gonna go into File, Manage Security and switch to the privilege set tab. You'll notice here there are three privilege sets already defined by default in FileMaker, Full Access, DataEntryOnly and ReadOnlyAccess. If I try to edit one of these by double clicking it, you'll see that everything is grayed out. I cannot edit the default privilege sets. If you want to use this privilege set as a starting point for a new privilege set, you can duplicate it and edit from there. But in this case, I'm gonna create a new privilege set. You'll notice on my new privilege set that everything is disabled. FileMaker uses the rule of least privilege, which requires you to explicitly grant access to everything in the database. So for our technicians privilege set, I'm gonna go back to our rules. So I'm gonna set up custom privileges for the records because I don't want them to create and edit in all tables. I don't even want them to create and edit in all tables. I do need them to be able to edit in some tables. So under custom privileges, first for the customers, yes, they can view all records, but they cannot edit, create or delete, and they have access to all fields. For assets, these technicians can view and edit records, not create, not delete, and again, have access to all fields. And then I'm gonna leave any new table set to no and none. And that's simply because when I add a new table to the database, once it's all ready to go, I'll need to come back in and explicitly, again, grant access to users to that new table. And one other thing here, I do have this option under fields and all these other pop-ups to choose limited. And what limited does is lets me set a calculation. So for example, in our sales person example, we could set a custom calculation that says for customers, users can edit when the account name or the logged in user matches the owner of that customer record. Once I've got that set, I'm gonna allow all layouts and value lists to be view only and scripts to be executable but not modifiable. Now I'm gonna allow these users to print and export, disconnect them when idle and allow them to modify their own password and set in some best practice password requirements, all menu commands. And finally, give them access via the FileMaker network and FileMaker web direct. So now the technicians privilege set is ready to go and I'm ready to go in and create an account. So Ryan is one of my technicians, so I'm gonna create an account for him. I'm going to give him a password and I'm gonna require him to change that password when he first logs in and then set him up with the technician's access. Now that this is set up, again, because I've modified my security, I need to confirm that I know the full access credentials. And now I'm gonna close the database and log back in using that new account I just created for Ryan and his new password. And you'll notice, again, I have to change his password right away, create a new password and say, okay, and now I'm logged in. And if I wanna go in and say, oh, I wanna add a website for this customer, I can't because my access privileges do not allow me to edit records. But if I go over to Asset Details and scroll down and try to put in a note, like I can edit this record. So again, you want to set up accounts and privilege sets, privilege sets for every group of users or every security level, like managers, executives, and staff, and then set up accounts for every individual who will be using your database. So the next thing you can do, if you have hundreds or even a few dozen users, setting up individual accounts can be a real pain and managing those. So another option you have is to have FileMaker participate in an external authentication or your existing Active Directory or Open Directory scheme. And to do that, you tell FileMaker to create a group account that is authenticated via an external server and then match it up to a privilege set. So generally you'll have one group per privilege set. And then when a user logs in, they'll log in using their domain, their Active or Open Directory credentials. And they'll be granted access at the privilege set level. So a couple of things about external authentication. First, it requires that the database be hosted on FileMaker server. But it has some big advantages. It allows you to leverage your existing security infrastructure and let the identity experts, those people who manage your Active or Open Directory server, do what they do well, which is manage identity and passwords. It means you don't have to manage those individual accounts in FileMaker. And it also gives users single sign-on in a Windows environment. Once a user signs into their workstation with their credentials, FileMaker will pick up their authentication token and pass it on to the domain server and get back that, yes, you have access to this file or you do not. And one other thing is it means that your users only need to remember one set of credentials, one username and password. Or you can use stronger passwords because you can set more precise or more complex password rules in a domain account. You can use higher security like two factor authentication. You know, and finally, it's a good way to minimize risk from a disgruntled or laid off or dangerous employee. Because as soon as that domain account is disabled, that user will lose access to FileMaker systems in addition to all the other things that are granted through Active Directory. So let me just show you the differences in how to set up an external account. Again, manage security, oops, except I'm still logged in as my limited privilege user. So let me re-log in with full access and go to manage security. I'm gonna again create a new account and here instead of authenticating via FileMaker, it will be authenticated via the external server and I'll call this FileMaker Technicians and again, match it up to my technicians privilege set. So now anybody in Active Directory who is in the group FM underscore technicians will have access to the equipment rental system. And again, I need to confirm my own credentials to be able to do that or confirm the full access credentials. So we've now secured our database, we've set up some privilege sets. So the last thing we wanna do is ensure the integrity and security of our database file itself. And there are two things to do here. One is turn on file access control. And what this does is it limits the ability of someone using FileMaker, creating a new database and connecting up to your now secured FileMaker database to add the tables from your file to the schema in their own file. And so to do that, it's also in managed security on the file access tab. So let's go ahead and do that. So again, manage security and then the file access tab. So all I'm gonna do is say, if you want to link to this file, you need to have full access privileges. The other thing I'm going to do is I've got a second file in my FileMaker system that's used for reporting. So I'm going to explicitly give my reports file access to this database. And again, to do that, I need to log into that file, which as you've noticed, I haven't secured, but now that reports file is authorized. And what FileMaker has done is it's added a key to each file to say, okay, you file, you reports file are authorized to access data from Equipments Rentals. And now anytime I make copies of these files and move them around as a set, they'll, the copies will also be authorized. And this is a good thing if you think about it, because if you end up restoring from a backup, you want those backups to still be authorized. And if at any time you want to deauthorize, you can just click deauthorize and that will pull that key out of the, the second file and it will no longer be allowed to connect to the Equipment Rentals file. And again, I need to enter my full access credentials to be able to make a change and manage security. So the last piece of ensuring your database security is turning on encryption at rest. And this is new in FileMaker 13 and it does require FileMaker Pro Advanced to enable. And so what encryption at rest does is it protects your data when an unauthorized person gains physical access to your FileMaker file. You've lost a thumb drive. Someone steals your laptop. A backup truck or a backup tape falls off a truck. In any of those cases, an unauthorized user could try to open and maybe gain access to data inside your database. If that data is encrypted, they won't be able to make any sense of the data inside your database. One key thing, when you encrypt a file, you set up an encryption password. If you lose that encryption password, you have lost all access to your database. There's no way to recover from losing that password. So it's very important that you do know what that password is and that's a password you might want to write down but then lock in a secure place. And so to enable encryption at rest, you're gonna use the tools menu in FileMaker Pro Advanced and go to developer utilities and then set up the solution and turn on enable encryption at rest. So let me show you how to do that now. So the first thing is when you're using the developer tools, the file needs to be closed. So I'm gonna close equipment rentals and bring up developer utilities and now I'm going to add equipment rentals to the group of files that I am encrypting. If I have many files in a solution, I can encrypt them all at once. I'm just gonna rename this to be encrypted files E so that I have that copy of the file and FileMaker will always make a copy of the file and then I'm gonna put it in my encrypted files folder. Now I'm gonna collect, I'm going to specify the options I want. In this case, I'm going to enable encryption. So the first thing you'll note is there's this shared ID. The default is a timestamp, you can leave it with that. And again, this is a shared ID if I have multiple files that I'm encrypting at the same time or I want to come back later and add a file to my encryption set. As long as all these files have the same shared ID, they will be able to be encrypted and decrypted together with the same password. Next thing I need to do is specify that I do in fact know the full access password for this file. And then the last thing is I need to put in an encryption password and you want this to be a very secure password. And you want it to be pretty much a random or close to random selection of letters and numbers and other symbols. So in this case, I'm gonna type something and you'll notice it's still weak as it gets longer it becomes moderately strong. And eventually it gets to the strong meter and I do have to type it twice and eventually they match. And then I'm gonna give myself a hint. This is a special day but I challenge anyone to guess what that special day is and what my full long password says. So once I've done all of that, the last choice I have is whether or not I want to keep open storage. By default if you encrypt a database, FileMaker will also encrypt any externally stored containers with the same 256 bit encryption. If for some reason you want to keep the access to those files open, you can check this box to keep open storage of your external containers. So once I've done all of that, I'm going to click create and FileMaker will make a copy and then encrypt my file and over here in my encrypted files folder, I have a log and my encrypted file. If I double click that, the first thing I have to do is enter the encryption password, which is that long thing I typed and then I open the database. Now that the database is open, I still need to authenticate as a authorized user and once I've done that, I can then open the file. So now that file will be encrypted wherever it is and if you do not know the encryption password, you will not be able to open it. One note there, if the file is hosted on FileMaker server, only the server administrator needs to enter the encryption key or the encryption password when they first open the file. After that, FileMaker server has the database open and users will be able to authenticate as normal to that database. So now that we've secured our FileMaker database, I just wanna add a few more additional tips. The first is test everything. As you set up access and set up your privilege sets, you'll wanna have a test account for every privilege set so that you can test your scripts and layouts to make sure that they behave the way you expect them to. There's some good notes on a testing protocol in the FileMaker security guide. If you have a multi-file solution and you're using internal to FileMaker accounts, you can use the account management script steps to ease account management. For example, when you add a new account to that system, you can use scripts to propagate that account from the main file to all the other files in the solution. Next, you can use things like object visibility and scripts and script triggers to improve the user experience around security. And scripting can help you do things like manage and access log or capture record change details for an audit log. And finally, I just want to drive home the point that security through obscurity isn't security. If you want to secure a FileMaker database, use the tools that are in FileMaker of privilege sets and accounts. Don't simply hide layouts and expect that users will not find them. I mean, using good, well-defined privilege sets and accounts will protect your data from both malicious and accidental loss through user error. So now we have fully secured our FileMaker Pro solution. And now we're gonna let's host it on FileMaker server to really improve the security and take advantage of all the other tools offered in the FileMaker platform. So why do we want to host on server? First, if you've set up your server properly and put it in a locked room, it gives you physical security.  FileMaker server helps you minimize risks by doing things like automatic backups. And finally, server is required for external authentication for encrypting the traffic over the wire between your host and your FileMaker clients through SSL. And finally, FileMaker server gives you a file access filter so that users only see the databases they have access to when they use open remote in FileMaker Pro. And finally, FileMaker server sits in the middle of the FileMaker platform's unified security environment. If you put your database server behind a firewall and your web server in the DMZ, the security between the two using SSL will protect any traffic from network sniffers and it will also protect your core database because only the web server is outside your firewall. In addition, any security between FileMaker server and FileMaker clients, the server and web components and the server and your directory servers applies to any database that's hosted on that FileMaker server. And security settings in each file apply regardless of what kind of client is accessing the databases. So WebDirect will take advantage of your external authentication if it's set up. So there's a few places in FileMaker server admin console where you want to go to secure things. So first of all, on the security tab, you'll want to do things like turn on external authentication and secure connections to your FileMaker server. And then on the clients tab, you want to set the idle timeout because setting the idle timeout will do things like protect you from the user who walks away from their computer and stays logged in so that another user or another person can't walk up to their computer and start accessing the database when their computer is idle. So here's a screenshot of those settings and now let me go in and demonstrate securing FileMaker server. So I'm going to switch to my web browser and bring up the admin console and start by going to the database server area and the security tab. So I've already got my server set up for FileMaker and external server accounts. Then I'm going to turn on the file display filter and finally I'm going to require secure connections to the server and still turn on progressive downloading so that users who are accessing movies or large PDFs can get them as chunks and don't have to wait for the full download to happen first. And then I'm going to save those changes. Next, I'll set the idle timeout by switching to the FileMaker clients tab and setting that maximum idle time to maybe 10 minutes so that if a user walks away and isn't actively using the database, they're going to be forcibly logged out of the database and required to log back in when they come back to their desk. Let me save that change as well. So now I've done some things to, again, secure my FileMaker environment on the server. And there are a few more things that you can do to go even further and the details on how to do all of these are in the FileMaker security guide. You should secure your SMTP warnings via SSL so that email sent via FileMaker server and warnings sent from FileMaker server are encrypted when you're connecting to the mail server. You can set up administrator groups so that individual DBAs don't have to have full access to everything on your FileMaker server. And finally, turn on email notifications for warnings and errors and monitor your access logs to see if users are trying and failing repeatedly to access your FileMaker systems. And finally, I'm just going to leave you with a thought that risk is what is left over after we think we have thought of everything. And what that's really saying is, think of as much as you can, but still take those steps in your FileMaker solutions and in all of your IT systems to minimize the risk so that you don't have to think of everything. And with that, I'm going to turn the session back over to Ryan for questions and answers. Thanks, Rosemary. Fantastic presentation. And thanks to everyone who is asking questions throughout the demo. We had a lot of participation right here. And we'll try to answer as many questions as we can. And we'll start with this one right now. Are the backups of encrypted databases encrypted as well? Yes, backups are also encrypted. So if you turn on that encryption at rest, wherever your file is, it will be encrypted including on backup tapes or other backup media. Excellent. So the next question, is there a way to set requirements for passwords? For example, you must contain an uppercase, lowercase, numbers, or special characters. FileMaker does not have any place where you can require password complexity. The only setting you have is in the defining of privilege sets, you can define a minimum length. If you need to enforce password complexity rules, you need to use external authentication because both Active Directory and Open Directory do give you the ability to require a degree of password complexity. Perfect. All right, the next question. Can you change your password using WebDirect? Can you change your password using WebDirect? I do not think that a WebDirect user can directly change their password as you can in FileMaker Pro with the change password menu command, but you could use the account management scripts to give a user a scripted ability to change their WebDirect password. Again, provided you're using FileMaker authenticated accounts. Excellent. Okay, so I think we'll do about two more questions here. When encrypting files, is every object in the database encrypted or is it just the data? When you encrypt a file, everything that's stored in the database is encrypted, and then the default behavior is to also encrypt those externally stored containers. So yes, everything is encrypted. Perfect. Okay, so the last question for the day. Should you have more than one full access account in your file? So, I recommend that you have an account for every user in the file. So if you have three developers working on a file, you should have probably three full access accounts. But I would also recommend that those users, if they're just going to be using the database and not doing development, log in with access restricted to whatever their normal role would be. Simply to, again, minimize the accidental risk of data loss and damage to your database. Perfect. Okay, so let's talk about some next steps. I mean, we already talked about the FileMaker training series basics guide and the FileMaker security guide is a great follow-up to the session. But if you're ready to consider licensing and want to purchase more than five seats, you want to contact your volume licensing sales rep at either the URL posted at the top of your screen or you can call at 1-800-725-2747. And FileMaker currently offers an annual volume licensing program with monthly prices starting as low as $9 for FileMaker Pro and $29 for FileMaker Server. We have another great list of resources here. We talked about, again, the FileMaker security guide, which you can access at this URL here. I'd also want to add another resource. If you go to FileMaker's website, the FileMaker training page, it's a great link for videos and tutorials, place of research, self-paced and instructor-led training and further information about FileMaker certification program. And with that, we'll wrap it up. On behalf of Rosemary and FileMaker, it's been our pleasure to talk to you today and we'll talk to you again next time.