From theCUBE Studios in Palo Alto in Boston, connecting with thought leaders all around the world, this is a CUBE conversation. Hey, welcome back, you're ready. Jeff Frick here with theCUBE. We're coming to you today from our Palo Alto studios, talking about a really important topic and that's data. And as we hear over and over and over right, data's the new oil, data's the new currency, data's driving business decisions, data drives AI, data drives machine learning. Data is increasingly important and we're still kind of waiting for it to show up on balance sheets, which is kind of implied in a lot of the big valuations that we see in companies that are built on data. But one of the important things about data is taking care of it. And we're excited to have our next guest here to talk about some of the things you need to think about and best practices in securing your data, backing up your data, protecting your data. And we're joined today by Tim Berlowski. He is the Senior Director Product Management from Veritas, joining us from remote, I believe you're in Minnesota. Great, Tim, great to see you. Yep, thanks for having me. Absolutely, so let's just jump into it. So all we hear about is data these days. It's such an important topic that is growing exponentially and it's structured and it's unstructured and it's so core to the business and are you making database decisions and are you getting enough data to drive your AI and your machine learning algorithms? I mean, data is only exploding. You've been in this business for a long, a long, long time. I wonder if you can share your perspective when you hear these things, more data's gonna be created in the next 15 minutes than was in the entire history of man before us or I'm making that up, but it's been quite an explosion. Yeah, I know where you're coming from and frankly, I don't even put that in my presentation anymore because it's a lot like saying gravity exists and things that you drop out of a window will fall to the ground. Everyone's heard it, everyone's aware of it. The numbers are just so staggering. You don't even know what to do with it. Like how many iPhones could you stack to the moon and back and then to Saturn? It doesn't make sense, but the truth is we are seeing an explosion. Everyone knows it, we have to manage it better. Now for us, a lot of what we do is in this data protection space where we want to make sure that data is protected and always available and all of the data that's been created and the growth in mission critical applications. It's no longer seven to 20 mission critical applications. It's hundreds and hundreds of mission critical applications means you have to be ready with a recent recovery if necessary and you need to provide that data back to the consumer as quickly as you possibly can because you've got people waiting on it. We've all got our apps on our phone. We're looking at our bank account 24 seven. We don't wait until a teller appears at 9 a.m. anymore. It's not the world we live in. Right, and I'm just curious if you've got some tailwinds in terms of, you've been in this market for a very long time in terms of people finally realizing that their data is really more of an asset than a liability and the investments to gather it, protect it, analyze it, have it ready for a refresh if there's some problem is really, it's a positive investment towards kind of revenue and strategic importance to the company as opposed to kind of a back office IT function that we're kind of taking care of business because we have to. Boy, that one really varies a lot by company. I see companies taking shortcuts and outsourcing and then suddenly you'll see them in the news and they discover that they had a major outage for a couple of days and suddenly practices change very, very quickly. The relative comprehensive, sturdy and reliable infrastructure that people run today sometimes lulls people into false security and then you see a major airlines with a multi-day outage and you go, hmm, I think we missed a few steps in the process. And so it sometimes takes those rude awakenings but the companies who are really taking it seriously and starting to practice pruning their data, examining their data for PII. So they meet various compliance regimes and other in various states and countries and starting to think about their backup stream really being how do we get a fast recovery instead of how do I make a copy which I will never use again are really starting to drive a more efficient IT operation when it comes to data protection. It's an interesting take in reference to having some issue because we do a lot of stuff around security which is related to but not equal to this conversation. And one of the topics in security is that most people have already been breached. It's just a function of how fast can you find out and how fast can you minimize the damage and how fast can you move on. Why are they breaching? They're breaching to get the data. So I would imagine with this constant reading in the newspaper of who is breached here and everywhere, pretty much every day that that's got to be a huge driver in terms of people kind of upping their game in this sophistication of the way they really think about data protection. It is, and I'll tell you, I've had the misfortune I would say of talking to customers who are in the middle of recovering from a major ransomware malware attack. And it's a very difficult proposition. And what customers often discover is they haven't practiced enough. They don't have enough of a DR plan present. We are certainly rising to the occasion. Our products are sort of the last thing that often stand between the customer losing their data completely. And so we're looking at a number of technology innovations that will enable them to store their data on immutable devices and for the backup infrastructure to be completely aware of that, which will be announcing later this summer, which we're very excited about. And of course, you know, from our perspective, for our appliance portfolio, we've always provided a couple of extra layers of security against intrusion detection and intrusion prevention right out of the box because we know the backup infrastructure becomes this collection of the very most important data in your infrastructure because that's the thing you back up and you want to restore if there's ever any sort of man-made disaster or otherwise. Right. So I want to shift gears a little bit and talk about kind of the evolution of the infrastructure kind of a scene, if you will, right? With the rise of public clouds, you know, with Amazon and Google and Microsoft Azure. And then, you know, obviously, you got your tried and true data center. Lot of talk about HP Discover this week about, you know, kind of going from edge to cloud and data center in the middle. So the environment in which these applications live and these applications run and where the data is relative to those applications is evolved dramatically over the last, I don't know, you probably have a much better time perspective than I did, five years, 10 years, but it continues to accelerate in this kind of application-centric world versus, you know, kind of an infrastructure-centric world. Just curious to get your take on, you know, kind of the challenges that presents to your company and to what you guys are trying to accomplish and how do you see that continuing to evolve and get not simpler, but more complex over time? That is a very astute acknowledgement of what's going on in the industry. And I often call it, the industry's getting weirder. I would have thought at some point we'd sort of have Linux and Windows and a couple of database vendors. And the truth is the database vendors exploded. And it's not just Linux anymore, it's containers. And it might be a container based on CentOS and it might be a container running in the cloud or it might be a simple function, like a Lambda function running on nothing in AWS. And so this whole world has gotten a lot stranger. From our perspective, I think the biggest change for Veritas has been a renewed focus on APIs that we make public to customers and ways that we can glue and stitch these systems together. Now, of course, it doesn't replace the deep integration we do with companies like VMware, with Docker, as well as the container ecosystem around OpenShift and some of those technologies. But from our perspective, we've had to be a little bit more prolific in what we support. And the truth is, it's all files, it's all objects, it's all things we've done before, but they just keep bubbling up in new and different ways. Right, but what's interesting though is you touch on all kinds of stuff there with Kubernetes and clouds and containers is a lot of it's kind of ethereal, right? The whole idea of a cloud-based infrastructure is that you can bring it up and bring it down as you need it, you can adjust it as you go and literally turn it off when you don't need it and bring it back up. And then you add to that serverless and this kind of increasing atomization of all the different parts of compute. Kind of an interesting thing for you guys to try to back up as these things are created and destructed and we hear these crazy stories of automating Kubernetes to spin up tons of these things at a time and then bring them back down. And then I'm curious too, within that is also the open source kind of challenge and continuing to have evolution in open source technologies, APIs, et cetera. So it is, I like getting weirder and weirder on a number of fronts as you guys continue to evolve with the market. Absolutely, and I'll tell you, you have to think about all technologies as being on a bridge. As I remind people, we have washing machines, they work really well, but washboards still exist even though it's a technology from 18th century or beforehand. Now, they might be used as they'll still do exist. Now, my point in this is people need a bridge. Most enterprises run on an amazing amount of technology they've developed as a stack over the last 10 to 15 years and they can't immediately rewrite that and put it all in a cloud container. So we're actually seeing a lot of use of containers and Kubernetes with fairly heavy application stacks. When you think about something as heavy as all of Oracle inside of a container, you can understand that is a big lift for a container and it's not ephemeral at all. But then it reaches out to storage that has that persistence value and that's where we come in because we want to make sure that persistent storage is always protected and easily available to the customer for any recovery needs. Great, so I want to shift gears a little bit, Tim, to talk about regulations and compliance because as we know regulatory requirements drive a lot of behavior and activity and really oftentimes are ahead of maybe the business prerogative to do things like provide backups, provide quick and easy access because you need it for a Freedom of Information Act request or you need it for some type of court type of activity. So I wonder if you can kind of talk about how the regulatory environment continues to evolve over time and how does that impact what you guys are doing in the marketplace? Great question.  Then we're seeing the California Privacy Act come in and a number of other states are considering legislation in this area. In some ways, it's actually been a good new story for data protection and data management because people are starting to say I should identify where the data is, I should figure out where the PII is and I should make sure I'm actually using my backups for the right purposes, which is something we've always believed in. We've always thought, hey, Mr. Customer, I see you're backing up an Oracle database for 10 years. What are you going to do with it in 10 years? Are you going to install Oracle 7 and reboot it? Doesn't really add up to me. So how can you get to a true archive for that data you really need archived? And then for your backup set, how can you keep it lean and mean and just keep it for the length of time you actually need it, which for many customers, could be as little as 14, 15 days, maybe six months, maybe a year, but it's often not those extreme retentions people were thinking of when they were building their tape-based infrastructure 10 years ago. Right, that's funny, because as you mentioned that, all's I'm thinking of is big data, right? And this constant kind of conversation in the big data world is, do you keep everything forever with the hopes that at some point in time, there may be a different algorithm or a different kind of process you might run on that that you didn't think about, right? Kind of schema on read versus schema on write. But to your point, is that necessarily something that has to be backed up? But it sounds like a lot of policy-driven activity then to drive the software to define what you back up, what you don't back up, how you back it up, how long you back it up. And a lot of, you know, kind of business decisions as opposed to technology decisions. Absolutely, and that's been on the back of, you know, the price of storing a bit of data has declined over the last 10 years, you know, on average 15% year over year for a very long time. So people have ignored the problem, but the truth is when you're really working at scale, there's a tremendous amount of waste. And we've identified for customers using our data analytics technology, millions of dollars of cost savings where they were both had storing files on, you know, expensive primary tier one storage and they were backing up that same bit of information every single week, even though it hadn't changed or hadn't been read in seven plus years. And they couldn't find an odor for the information in the company. They literally didn't know why they had it. And I think people are starting to consider that, especially in budget constrained times. Right, it's so funny, right? Sometimes it's such a simple answer. A friend one time had a startup and he was doing contract management. This is 20 years ago. And I was like, how do you manage the complexity of contracts inside software? Again, 20 years ago. And he said, Jeff, that's not it at all. We just need to know like, where is the contract? Who signed it and when does it expire? And they built a business on answering simple questions like that. It's sometimes it's the simple stuff that's the hard stuff. But I want to shift gears a little bit, Tim, on what Veritas is doing in the market in terms of still having appliances. You know, I'm sure a lot of people like, wait appliances, why are we still using appliances? This is a software defined world and everything just runs on x86 architecture. You guys still have appliances. Tell us a little bit about the why. And some of the benefits of having kind of a dedicated hardware, software piece of equipment versus just a pure software solution that sits on anybody's box. That's a great question. Thanks for asking. When I think about that world, you have to understand Veritas at its core is absolutely a software company. We build software and we preserve the choice in how the customer implements. When I say we preserve choice, we obviously still support old school Unix. We certainly have an enormous investment in the x86 world, both on Windows and various Linux flavors. And of course you can run the same software in the cloud. And of course you can run it inside of a virtualized infrastructure. So we always like to preserve choice. Now, why did we create the appliance business? It's frankly because customers ask us to. The thing that made storing backups on disk affordable was this technology known as deduplication, which at its heart is just a fancy kind of compression that's very, very good at copies of data where there's a lot of blocks that have been seen before. And so we don't store them if we've seen them before. We simply store the ones that are new and fresh. So from our perspective, customers said we want this technology and the market really moved away from general purpose solutions on servers to do that because it was very hard to build something that could have a very high throughput, very high memory. And at the same time could give excellent support for random access reads when the customer actually needed to read that data. And so we created purpose built appliances as a result. And what we discovered in the process was there were a lot of pieces that were actually fairly hard in the enterprise. So when a customer would describe the purchasing process of their typical solution before appliances, they would talk about filing tickets with the server team, filing tickets with the storage team, filing tickets with security team. And sometimes taking six or nine months to get a piece of equipment ready to install the backups off around the floor. Whereas with ours, they placed in order, it showed up on the dock. As soon as it was in the rack, they were ready to go and working independently. Now while we have a great and thriving appliance business we're very proud of, we always preserve choice at Veritas. And even though that's the business I represent, I would make sure our customers always understand that we're interested in the best platform for the customer. So that's our basic perspective. If you want to go deeper, let me know where you have questions. Well, I'm curious on the process, when there's a fail, when there's attack, when there's ransomware, whatever, when you need to go back to your backup, what are some of the things that your approach enables or what are kind of the typical stumbling blocks that are the hardest things to overcome that people miss when they're planning for that or thinking about it, that kind of rear their ugly heads when the time comes that, oh, I guess we need to go back to a backup version. Yeah, and I'll break that into this disaster recovery or restore process and then also the process of backup. So when you think about that disaster recovery and I'll use ransomware as that piece of it because that's the real kind of disaster when you're looking at equipment in the infrastructure which has been wiped clean. And that's a worst case scenario for most IT managers. When you think about that situation, we've built into our appliances, first of all, a hardened Linux OS, meaning we've shrank down that OS as much as we possibly could. Second, we've added role-based access protection to make sure that you simply can't log in and perform activities which you're not privileged to perform. And then we have intrusion protection software, intrusion detection software to ensure that even for those zero-day attacks that we may not even be aware of when we release our software that the system is hardened. Of course, you have firewalls and Stig rules. Stig's rules are a DOD standard for hardening Linux-based devices. So we've got a hardened device and I was talking to a customer in a different part of the world this week where they describe having a data center where everything had been wiped and there's one thing left, their net backup appliances. And they were able to then take that and use that for the restore because that was a real vault for their data. Now, the flip side is that's a rare day.  When you think about day-to-day and we're running a data protection operation, really think about speed of backup. And for us, being able to take something that's neatly tuned for the hardware, the operating system, the tuning, the net backup softwares all configured out of the box and ready to go. And the data protection folks can be independently able to drive that is a great value because essentially you have Lego style building blocks where you can order a device, you know it always performs the same and three years from now you don't have to redesign it and take your expensive IT staff and ask them to figure out what's the best solution. We've just got another one off the shelf for you and another series in the model. Now, as you said earlier, the world's getting weirder. It definitely is. So we'll be branching off into what kind of appliances we offer and you'll see some announcements later in the year where we'll be offering some reference architecture approaches which will be a little different than what we offer today just to meet the customer demand that's out there. Yeah, that's great. I mean, because as you said, it's all about customer choice and meeting the customer where they want to meet. But before I let you go, this is a pretty interesting conversation. I want to get your perspective of someone who's been in the business for a really long time.  But as they continue to get weirder and weirder, where do you see kind of the evolution?  Boy, that's a great question. So this is yet another wave. And that's often how I look at it, meaning there was a wave of Unix. There was a wave of Windows. There was a wave of virtualization. And each of these technologies brought some real shifts to our environment. I think, from my perspective, the next big wave is dealing with ransomware and some of these compliance requirements we talked about earlier. And then I can't get away from this big data AI piece. And my son's studying computer science in college and that's a weekly conversation for us. What's new in that front? Because I think we're going to see a lot more technology developed there. We are just truly on the beginning of that curve. And frankly, when I think about the companies I work with, they have a tremendous amount of data, but that's really only going to increase as they realize they can actually develop value from it. And as you mentioned, first thing, once it shows up on the balance sheet, suddenly everyone's going to get very excited about that. Yeah, it's so funny, right? Because it basically does show up on the balance sheet of Facebook and it shows up on the balance sheet of Google, but it's just not a line item. And I keep waiting for the tipping point to happen where that becomes a line item on the balance sheet. Because increasingly, that is arguably the most important asset, or certainly the information and learning that goes around that data. You're right, and frankly, it's an insurable asset at this point. You can go to a company in a number of commercial settings and get ransomware insurance, for instance. So people are definitely recognizing the value of it if they're willing to insure it. Right, right. All right, Tim, well, thank you very much for stopping by and giving us an update. Really interesting times in, you know, kind of taking care of business and really the core of the business, which is the data inside the business. So important work and thanks for taking a few minutes. All right, thanks. I'll be glad to be back anytime you want me. All righty. All right, he's Tim. I'm Jeff, you're watching theCUBE. Thanks for watching. We'll see you next time.


So, now let me come to the point that one of you asked, what about existence? Now, remember Weistra's theorem gave us existence under what condition? The objective function has to be continuous and the feasible region has to be closed and bounded. I said a feasible region that is open is not closed and could be bounded, but it is not necessarily closed. So, there are, there are these strain sets that are both closed and open, let us not bother about them. Basically, there is no guarantee of closed and being closed. So, then therefore you need another in an independent way of verifying that the solution actually exists. It also brings me back to the first point I had made. We need the reason, the importance of Weistra's theorem in optimization is that it lets you check for a, that a solution exists without actually asking you to find one. So, now without having a guarantee, a way of claiming that a solution exists, you can be in this kind of situation. You just try and find one and then you find all these points, but then none of them, there is no guarantee about any of them. They could be solutions, could be not, nothing can be said. Now also let us go, if you go back to the argument, the way we proved this right. So, we started with this theorem saying let X star be an optimal solution of this particular optimization problem. And what did we do? We said, we took this particular optimization problem and we said let us look at this optimization, let us look at every direction in Rn, swing that direction down to the point where now it lies inside the ball and therefore inside the set and then you can say something about the inner product between the direction and the derivative. So, this kind of argument can also be done if you are talking of not a global optimal solution, but a local optimal solution. So, here I was referring to optimal solution means a global optimal solution, I use this particular thing, this particular property. I use this that f of X star is less than equal to f of X for all X in S, but then we do not need to do that, we can also work with a local optimal solution and your entire local optimal your earlier ideas will continue to work. I can still look for a vector that is in my local neighborhood, that neighborhood can I can shrink that vector further down to the point where it lies completely in S and again do complete repeat the same argument. So, what this means is this particular result actually also gives us, so this theorem, the above theorem also holds for X star that are local optimal, local optimal solutions or local minimum. So, what this means is if X star is a local minimum, my thing is function f X in S evaluated at X star equal, so now suppose you get to this situation where you now have you are in one of these situations, you have you know that the solution exists, but then there are multiple points where there are multiple points more than one point X star that solves that derivative equal to 0 or gradient equal to 0. So, what so can we eliminate some of these, so that is what we can look at now. So, let us consider this, so suppose f is twice differentiable, let X star local then it must be that derivative is equal to 0. And now we can actually use a stronger version of Taylor's theorem. So, when a function, when you have twice, when the function is twice differentiable, Taylor's theorem you can use Taylor's theorem to get that is a stronger version of Taylor's theorem that makes second use of also the second derivative. So, the Taylor's theorem I wrote here, this used only the first derivative and it was it said that you can construct a linear approximation of the function near that point. If you also have second derivative of information, then you can actually construct a quadratic approximation. So, that is a theorem that we will use. So, by Taylor's theorem, Taylor's theorem actually implies that f of X star plus delta H is equal to f of X star plus, so f of X star plus f X plus half delta square H transpose may be used just to be consistent with one kind of notation that we write. Plus now the quantity, the residual quantity that comes is now small o of delta square. So, you can construct a quadratic approximation and a quantity that the residual error that remains after that quadratic approximation is small o of delta square. What this means is this is now a function that after dividing by delta square also goes to 0, okay. This is that sort of quantity, alright. But now remember this because f is a X star is a local minimum, this gradient here is equal to 0. So, this first term is gone.  And now once again we have in a small neighborhood f of X star plus delta H will be greater than equal to f of X star. So, for delta small enough, what this implies is that you have half delta square H transpose for delta positive and small enough. What that means is as if you can divide by delta and then let delta go to 0 that gives that H transpose is greater than equal to 0. Now this must be true for this, you get this condition the H transpose Hessian of H f at X star times H this should be greater than equal to 0. You get this condition, this should be true, this is true for all H, this is true for all H. Since this is true for all H, this just a matrix like this, a matrix like this that satisfies this kind of inequality matrix of this kind which satisfies an inequality like this for all H, this sort of matrix is called positive semi definite. Let me just define that for you here, m n cross n is said to be semi definite v transpose nv is greater than equal to 0 for all v in R n. So, with this definition what we get is that you look at this Hessian matrix evaluated at X star, this must be positive semi definite. So, if your f is twice differentiable, we can say more, we can say that if your X star is a local minimum not only must the derivative be equal to 0, then amongst the point where the derivative is equal to 0, you further check, you can further narrow down, you can say well there are these points where the Hessian is positive definite, then amongst, so those are your optimal solutions must be amongst those points because this is now a necessary condition. Now, what about sufficiency? Sufficiency means what necessary means simply that once it is a solution, this is a condition that the solution must satisfy. Sufficiency means the other way around. Sufficiency means the other way around, here is the condition if I get, if I can verify then definitely that is the solution. Now, what would be a sufficient condition in this case? So, sufficient conditions are stronger than necessary conditions because sufficient conditions would imply the necessary conditions. So, what would be the sufficient condition in this case? So, you must have that the derivative is equal to 0, that is necessary. You must also that and but in addition to this, the second derivative being or the Hessian being positive semi-definite, if we ask for something more, we ask for that the Hessian is strictly positive definite or positive definite, then that ensures that the X star is a local minimum. So, sufficient condition is strictly positive definite. What does that mean? That means that if I take V transpose del square f X star V, this is positive for all V that are not 0. So, if you have an X star in S such that the derivative is equal to 0 and the Hessian is positive definite that means V transpose the Hessian times V again is strictly positive for all V not equal to 0, then that X star is a local minimum. So, the optimization over open sets is that as does not always is not a very common problem that occurs. Usually, the kind of when one writes an optimization problem like this, you are writing a minimization of a function f subject to some G of X less than equal to 0 and H of X equal to 0, the less than equal to 0 and H of X equal to 0, these kind of constraints, if these functions G and H are continuous, then these constraints ensure that your set is actually closed, the feasible region is actually closed, but this closed if G, H are continuous. But a class of problems where it is very important to consider where we have, where we naturally encounter open set are those where there are no constraints. So, the problem of minimizing effects where X just is in Rn, all of Rn. So, this is what is called unconstrained minimization. So, unconstrained minimization, this is actually a minimization over an open set because Rn itself is an open set. So, all the previous results that I just mentioned, they all apply to minimization over an open set or so over an uncon, for a minimization of in an unconstrained set. So, you are unconstrained minimization. You can, another point to note is that suppose you had instead maximization, instead of minimization, how would the result change? Yes, so how would my R conclusions change? R conclusions, the conclusion of this theorem here that the derivative is equal to 0, this conclusion will continue to work, even if you had a maximization. The derivative will still has to be 0. The conclusion of this theorem, of this conclusion here, that this blue line here, that the Hessian must be positive semi-definite, that the Hessian should be positive semi-definite that gets changed to Hessian should be negative semi-definite. And the sufficient condition will change to Hessian should be negative instead of positive definite, negative definite. Negative definite simply means that in place of, in place of negative semi-definite would just switch this inequality to a less than equal to and this inequality also towards strictly less than. I am skipping over these details, you can easy to work out on that. So, we will end the class here.


Hello, everyone, and thank you so much for joining Brandon and I's introduction to Cloud Native Security. We are so excited that you are here, even if we can't see you, and we hope that you are staying happy and healthy wherever you are. Today, I'm going to get us started with a brief introduction about the special interest group for security, what we do, who we are, and why we're amazing. Then Brandon is going to jump in with some excellent resources for you to dig into later and even talk about some things that are going to make your lives and the Cloud Native Security community's lives better. I'll wrap things up with how you can get involved with this stellar group of folks and help move Cloud Native Security forward. Here we go. The mission of the special interest group for security in the Cloud Native Computing Foundation is to reduce risk that Cloud Native applications expose end user data or allow other unauthorized access. Everyone wants to protect their data and only allow authorized users access to applications. We're here to help make that possible in the community. We have three primary focus areas, ensuring the protection of Cloud Native systems while providing the needed access to authorized users and services, establishing a common understanding and common tooling to help developers meet security requirements and promote common tooling for audit and reasoning about system properties. And we do this through a lot of great opportunities within the SIG to include some major projects that we have underway. We're wrapping up our Cloud Native Security white paper and hopefully by the time you are hearing this, it will be published and linked in our repo. The white paper is designed to be a guide to your first Cloud Native security architecture. It was developed with love by the SIG and its members to help all teams and Cloud Native be more secure. We introduced a new model for Cloud Native security layers as you see in this diagram. It dives into each of these areas and features an executive summary. Later, we will be linking various sections with the new version of the CNCF's landscape, which is coming soon. The Cloud Native security white paper has a lot of excellent content, so be sure if you're reading through it that you take your time. With over 36 pages and a lot of great details, we can't wait to get your feedback and help make it that much better. This SIG does a lot to help ensure the security of Cloud Native projects while helping to identify projects that push more secure development and deployments. As you can see, we focused on quite a few different areas from container registries to key management and general security and compliance. It's important to us that the community continue to move forward with Cloud Native security and the assessments that we perform on these projects, as well as our special projects that we have like supply chain, help move that forward. Now over to Brandon. All right, thank you, Emily. So as SIG security, we have many different activities going on as always, and so we're going to go through a couple of these. So first and foremost, we have presentation discussions. These usually happen during our weekly meetings on Wednesdays, and these vary from presentations about projects such as Passag and KeyLime and other security projects to end user vendor stories and lessons about security. So on top of that, we have several discussions, and these topics are brought in by community members, so this could be technical where once we talked about the management and rating of CVEs for Cloud Native projects, to discussions about how we can collaborate on certain topics. For example, recently members of the Confidential Computing Consortium, the CCC, came to discuss what they were doing and also explore avenues to collaborate with parts of the Cloud Native ecosystem. So example of a security resource produced and maintained by the group is the supply chain catalog. This is the effort that resulted in a couple of interested members in the community. And what the security supply chain catalog is really is it provides a list of supply chain compromises and descriptions of, you know, what are some of the threats that apply to supply chain management. For example, we talk about a few different ideas like what does it mean for a threat called typosquadding? What the signing mean in the context of supply chains. So the document is meant to provide more both a means of education, but also serve to help security practitioners, convince management and decision makers on the importance of supply chain attacks. So as I mentioned earlier, this is community managed. So if this is something that you're interested in and you see a new supply chain compromise or would like to add more information about the threats and mitigations, please do come by and create a PR. So traditionally on top of our weekly meetings and when we don't have a pandemic going on, we hold in-person events co-located with KubeCon, Cloud NativeCon, or basically any security slash Cloud Native Conference that we have a forum of members at. So as we come to the close of 2020, we hope that the situation will get better soon. We, like many of you, look forward to seeing when we can continue in-person meetups safely.  So security assessments is something we do regularly. And to date, we have completed five security assessments for CNCF projects. These are Haber, Spiffy, Spire, InTotal, Opa, and Keycook. So audit is a security assessment. So first off, just to clarify, the term security assessment can be often overloaded. And so we just want to make it clear that a security assessment is not a security audit. To us, a security assessment is to be able to access the security posture of a project. This includes looking at the goals of the project and evaluating the amount of thought that has been given to the security aspects of the project. So this ranges from overall architecture and design patterns of the project, and includes also the evaluation of security processes by the project. For example, how does the project handle security issues and respond to security incidents? So the security assessment also helps the SIG provide recommendations to the CNCF Technical Oversight Committee or the CNCF TALK, for example, for projects that are incubating or graduating. And in certain cases, we also provide some feedback. For example, in the Spiffy-inspired assessment, we recommended that the project go to a security audit since it is a critical security component in the CNCF ecosystem. Finally, what comes out of the security assessment is a document, which we'll be seeing shortly, which provides an overview of the project and the security considerations. So at the end of it, this is a very useful document for both the project as a security.md type file. And in addition to that, for end users who would like to use the project and really don't know where to start in terms of security, this document will help guide them in terms of getting started and adapting the technology. So let's go take a look at an assessment. So what we have up here is kind of the overview of what the HABA assessment looks like. So the security assessment documents start off with, as you can see, details of the project, what the goals of the project, what does it do, and how does it work. Then we go into details of what the design architecture of the project is. So it ends up being a nice encapsulation of most of the details you would need to know about project starting from the ground up. After all that, we get into the call of the security analysis. So this usually consists of several parts, including the types of attacks, the attack capabilities that could be present, as well as for other different threats and mitigations. So in addition to this, security considerations also discuss here. For example, if a project uses a plugin or external database, what happens if the database on component gets compromised? So kind of a little bit of high level threat modeling that's happening in this section as well. So as you can see from this picture, this is actually a screenshot from the HABA assessment as well. You can see that in this case, different components being compromised would lead to different levels of risk being exposed. So this could help inform the decision if someone was to create a deploy HABA, they would be able to say, okay, looks like my compromise storage back end really is low risk. So I don't have to put as much controls as I would have example for a number 18, the compromise reddish cache. So I would want to put a lot more controls around reddish and then my storage back end, for example. And finally, we cover the implications of the project has in terms of the security of the cloud native ecosystem as well as the security processes of a project. For example, how does one file a security bug report? What is the process of handling that? And also the more technical aspect of this, right? So does the project have a DevSecOps pipeline? Are the releases of the project signed and how is the key stored, for example? And after the entire review is done, we create a one site summary for the TOC. And this covers briefly what the project is. As you can see on the left, we have the goals of design, security analysis and maturity, as well as some recommendations for the CNCF as well as for the project. So in the example we have here, this was from the OPA assessment. And one of the big findings that we had were that the policy language regal we found was difficult to use and sometimes would result in mistakes in writing policies. So for the CNCF, we had a recommendation that they should survey users of OPA to detect if they see any certain patterns of insecurity that may arise in policies. And for the project, we recommended that they improve the documentation as well as work on usability of the policy language. So that sums up the gist of an assessment. So if you find any of this really interesting to you, the good news is that you can volunteer to be a security assessment reviewer. Our team of reviewers has grown tremendously over the year and we've seen a lot of great new faces. And just in case you're not sold on that yet, there are many opportunities for professional development as well in participating with these reviewers. It provides an opportunity to really deeply dive into a new CNCF project or something that you've been always looking at and never really had the chance to look into. And throughout the entire review process, you have the other reviewers as well as the project maintainers who are there and really engage in the review. In addition to that, there are many networking opportunities, so both with the other six members as well as project maintainers and CNCF staff. So awesome, how do I get started? Security assessments are done in three-week sprints. The expectation is that one would spend a total of 10 hours over these three weeks dedicated to the review.  We currently have a security assessment that is almost ready to go. This is for cloud native build packs. So if you're interested, comment on the issue as well. Now here is how you can get involved with this wonderful group of individuals. And I know that you want to. Check out our repo and join one of our meetings.  We want you to listen in and learn or maybe if you are, present on a security topic. We've got over 68 members and we are growing strong, but we always need more passionate people such as yourself to help make our community even better and make cloud native security better too. There are lots of things for new members to do. We encourage you to read through the repo, familiarize yourself with who we are, what we're working on and how we run things. We love it when new members or folks looking to join, review our PRs, comment on them, improve them, submit issues in a proposal or even make a PR to close out an open issue. We've got some easy ones in there. We have labels for tickets that need help and sometimes just a quick review is all that's needed. As Brandon talked about, we've got presentations and proposals and suggestions and even security assessments that can all be excellent ways to contribute and grow the community. But it just starts by submitting an issue. You can learn more in our Slack channel, sig-security, in our meetings every Wednesday at 10 a.m. Pacific and through our mailing list. We look forward to seeing you at our next meeting and saying hi in Slack. Thanks, everyone.