First, under the gloomy sea, Annabelle Lee, and the other poem, Sea Fever, and then next, stopping by Woods, on a snowy evening, fine, four okay, and West Wind, there are two poems with almost the same title. One is the West Wind, and that's the one I wanted you to read. That's by John Masefield, the other one owed to the West Wind. That's another, by another poet named Shelly. We will definitely read that later when we study the book, Jonathan Livingstone, Seagull, because that poem, Ode to the West Wind, blends nicely with that story about seagulls. Now, we're going to add some more poems for you to read for this Wednesday. That adds up to 10 lyric poems that we will start with, start our poetry assignment by studying those 10 lyric poems. Now, when it comes to the study of poetry, this is a very interesting sign, poetry. He said it thinks it has to do with song, the sign for songs, poetry. Now, why songs? What? The violin? You're probably thinking of who was Nero, Roman what? Roman king? Nero the violinist? While Rome burned. What an artist dies in me. He thought himself as the world's best artist, paid more attention to writing short poetry than attending to the governance of the city of Rome. But that's another story.   I'm talking about the arts, poetry, drama, sculpture. And what was that civilization before Rome? Greece. That's right, Greece. G R E E C E Greece. Compare Rome to Greek. Many use sign Greek like this with the G by the nose. If you look at their sculpturing, you'll see the profile shaped like this. Hence the sign Greek. However, if you look at Roman sculpture, their profile was shaped like this. And that was called a Aculacline nose. But what? But like an eagle. So the sign is Roman, Roman. The study of Latin language. So don't confuse those two Greek and Roman. Okay.  What is meant by L Y R E? A liar was a, does anybody have an idea? What was an liar? Yes. It was a harp. A very small one. They had larger harps back in the day, which you plucked, or you had the smaller one that you could carry around. It was portable. And so that was the sign during Greek times. They believe that poetry as written or spoken was most pleasing if it was accompanied with a liar and they could follow the boom, the meter. So you get the idea, boom, boom, music, poetry, music, poetry. So the idea was about lyric poetry. Lyric was a poem that was meant to be sung, where you have to think as poetry as something else that is spoken, then sung. Singing is supposed to give pleasure to the listener. We who are deaf seem that we may be shut out from that pleasure, but do you think that's so? You can read, you can read, you can feel. What do you mean by feel? No, I'm talking about poetry. Do you hear the vibrations? No, you can't hear. You feel what? The feel the vibrations of what? Of music? But if you had a liar, you're probably right, but pushing that aside, if you just read, it silently makes you feel inspired based on your emotion. It's something inside of you. You read and think and imagine. You think and read. Part of music, you feel, you use your imagination. Can you imagine that? Read? Well, if you read the prose, not poetry, but everyday prose and still see the picture, still you seem to touch something. Touch a rough sidewalk, for example, when you're walking on, you know, walking in bare feet and you read. Just imagine that, can you? That's the same with poetry. I once wrote a poem and in that poem, I tried to picture that even though I can't hear, still through my imagination, I could imagine what the words sounded like. So I once wrote a poem like that. Let me start off by signing that poem to give you some idea of what the printed word can make us imagine. This is, quote, on his deafness. My ears are deaf, but still I seem to hear sweet nature's music and the sound of man. For I have learned from fancy artisans how written words can thrill the inner ear, just as they move the heart. And so for me, they also seem to ring out loud and free. In silent study, I've learned to tell each secret shade of meaning and to hear a magic harmony at once sincere that somehow notes the tinkle of a bell, the cooing of a dove, the swish of leaves, the raindrops pitter patter on the eaves, the lover's sigh, and the strumming of a guitar. And if I choose the rustle of a star, you get the idea? Reading and imagination can make us, quote, hear. Now, dealing with one of our sense experiences. One, do we have any other senses? A sixth? That's true. But what is the sixth? A six? Tacked? Something tactful? A six? What is the sixth sense? What? ESP? ESP? That's an idea. Hard to explain, right? What is it? When you sleep and someone walks into your room, you can't hear it.  Yeah, we use the word sign feel, but it's not exactly that because you're not really touching, touching anything. It's something inside. Some people, yeah, it's really hard to explain. It's something that is intuitive, but we sign this. That's true. It's something that we can have a lot of argument about, but we're talking about the five senses. One is hearing. What's the other? Smell, hearing, smell, taste, sight, feeling. It really means what? Touch. That's correct. Remember, it's more touch. Touch.  That's pretty rough there, huh? Okay, now you get the idea that all of us have, all of us have experienced the world through the senses, sight, hearing, taste, touch. For example, when you go to the seashore, you can see what you see in the water. What? You see the fish? Oh, if you look down deep, yeah. Maybe they're jumping. Okay. You see birds. What else? Huh? Colors? What colors? Blue, the blue sky, and you see green, the green water. So you see these things, all right? What do you hear? The sound of the ocean, the sound of the waves crashing. You hear rain? No, I'm talking about going to the beach. Oh, if it's raining, yeah. If it's raining, what else? The surf and the sounds. What else? They're very interesting. You feel it?  That's a good one. And you walk on the sand, the white sand. You walk it and you can hear the steps. But at the same time, you feel, what do you feel? You feel the texture of the sand. And if it's hot, if you're in the middle of the sun, you feel the sun on your back and the sun at the soles of your feet. What else?  What do you hear? You hear the waves? You hear yourself walking on the sand? What else do you hear? I'm talking about hearing. Imagine, what? Shells? You pick up a shell and put it up to your ear and you listen to it. Yes. What else? Sea gulls. Yeah, you hear them calling. They're fighting each other for fish.  What about other senses? Any other senses? About an airplane? But we're talking about the seashore. Limited to the sea. I have a special reason for that experience that you get from visiting the seashore. Colorful as the sun goes down. Color as it goes under the water. Okay, yeah. Wind. Wind. Especially if you are on a boat with a sail. The sail? Is it quiet? Or does it flap a lot? Can you imagine that? Oh, there wasn't experience. The hearing of the flapping of the sail? That's a different sound. What about smell? We haven't come to that. Oh, a fishy smell. Right.  Last. Taste. What do you taste? Salt? Salt water. Okay, fine. You see poetry deals with all of that. Yes. Poetry is short compared with prose. Every day language. It uses a lot of words. Often uses too many words. Poets carefully choose words. Very economical by carefully choosing. And each word should have a special impression on one of your senses. Now, so that's the idea. Now, we are going to go into the language of poetry. Image, image, image. Most of the time, if you think of a picture, we talk about a photographic image. You've seen that expression, right? Photographic image, likeness, a photo that looks the same as copied from there, reproduced. But images really relate to any of the senses. You can have an image that appeals to your sense of touch. You feel something rough. It doesn't feel good. Something sharp. Or image can appeal to your sense of sound. As we said before, the seagulls crying. So that's the idea. The idea, the concept that deals with all of the different sense experiences. We call that imagery. How do you pronounce that? Imagery, imagery, imagery, imagery, imagery, imagery.  Suppose that liar has five strings. Chords, we call them strings, five. And I strum the strings. Or suppose one of those strings that you pluck deals with the sense of taste. You pluck the string. When I read a poem, if it contains one word that deals with taste, and it say it was salt or the sea, sea spray, salt, sea spray. Can at the same time you can taste it and feel it. See the beach and the surf and the spray hitting you in the face. It's part of feeling it, tasting it, both. So you pluck the string and you get two of my senses that experience a sense, sense of touch and the sense of taste. So when you pluck the different strings, you get different senses activated. You get the idea. You put them all together, we call that sense experiences. They travel to the mind up to different strings. Or maybe they go to your heart depends which one. Both you're saying, right, both sometimes, right? Or it goes to your stomach and doesn't feel so good. When somebody scratches a chalkboard, that doesn't feel so good. That goes to the gut. Not such a good sensation, right? Anyway, now there are certain poems that I've asked you to study. What poem comes to mind based on this discussion? You know, what poem comes to mind from your outside reading that deals with a sea fever, sea fever. Okay, let's turn to that page now, sea fever, page 343, 343. Why don't you read the first verse again, just the first verse, the first stanza, the first four lines, page 343, 343. Read the first four lines. We're getting close. You read the first four lines and you feel the rhythm. Say the words, I must go down to the seashore again, to the lonely sea and sky. And all I ask is for a tall ship, massed, right? A tall ship and a sail and the stars and the wheels. What are the wheels? What were the wheels kick? Are there actual wheels? No. The controls? The rudder that you would have here? Or it could be connected to the wheel? A console, that's the right word. But what does kick mean? Kick, kick. When it says wheels kick, what kicks your, you kick the wheel? If you can drive on a rough road, sometimes holding the steering wheel will make it a little jerky. It kicks like a deer kick, getting kicked by an animal. That's the same with a boat as you traverse the water, it kicks back and forth and the wind and the white sails shaking, flapping in the wind, shaking, and the gray mist, again, gray mist on the sea face, misting ahead of you on the water and the fog all coming together and the white dawn breaking. What time does that refer to? Yes, early in the morning as the sun starts rising and the mist starts evaporating. Okay, now you say, I must go down to the sea, again, the lonely sea and sky. And all I ask is for a tall ship to lead. You see, the wheels kick and the wind kicks and the song, the white sails shaking. Do you feel a rhythm back and forth, back and forth, back? So poetry tries to make that rhythm sound almost as if the water and the waves are passing along. So you have the measured beat.  What is a beat? A heartbeat. Can you feel your heart beating? How fast is it now? How fast? You know, if you're sleeping right after lunch? Not? Okay. So your heart beats, boom, boom. When you run, right, it beats faster. Okay. So there's beats in many, many things. What other things have beats? Drums? Dance has a beat too. Yeah, right? That'll put you to sleep or it'll feel like a dope like trance. Everything, many things have a beat. That's the stuff of life. And poetry depends heavily on that, really. Not all poems have that, sometimes are written without a beat, without a meter. That means the same thing. Same idea. In poetry, poets try sometimes to create that beat, that sound, almost like the movement of what is happening. Sometimes poem can be about riding a horse and the beat will be much faster. Riding, riding, riding. Now the man came riding up to the end, or we'll read that one later, the highway man. But for now, we're looking at waves and the kick of the sea and the wind and the white sail on the mast. And when you read a poem, it tries to speak the words to yourself. Try to say it out loud. You will appreciate what feedback you get or the feeling. So you get feedback through feeling, whether it's your throat, your chest, you feel really good. It's a beautiful feeling. We also begin to see that poetry can appeal to us in other ways. In other words, when it comes to the sea and the sky, what does that tell you? Sea, sky. Interesting. It's long vowels. That poem has many simple vowels that stress long vowels, long A's, long E's, long I's, long O's, long U's. Poetry is like that. That's why you have rhymes. Rhymes, the last word, they must sound like sea of the loneliest or lonely sea and the sky. And all I ask is for a tall ship and a star to drive by. That's what interesting about that. Okay, there's again, the sense of sound. What else? What else about the visual images? What things touch or what things influence your sense of sight? You visualize a picture. What else is there? Anyone? Said the star. What else? The gray dawn with the sun coming up and the brightening of the sky. Beautiful sign language. Wow. See the sun coming up on the horizon. Makes its way up into the sky and brightens the day. Marvelous. If we only had color, it'd be a perfect picture, a perfect image of what you see, right? What else? What else? You see dawn breaking, the gray dawn breaking, the tall mass, the sailboat. What else is contained with this in the poem? What exact words do you see? We talked about the gray dawn breaking. I want the exact words. When you read poetry, you want to be careful that you see the poem under a microscope when you read, as if you're reading it under a microscope seeking clarification. So we also talk about I see air. I see a cloud. Oh, wait a minute. A tall ship, a star. You get the exact image, the exact idea. What else? A white sail. Yes, what else? Let's read the second stanza. Second four lines now. The second four lines. Like since chills up my side. That gives me goosebumps when I read this poem. Really. What other images do you see? Let's identify some more based on the words. Tide? The running tide. Yes. Right. What else? Seagulls. Great. See the images? The white clouds. Okay. Now let's talk about images that influence your sense of taste. What's listed here? Flung spray. The blown spray. What is flung spray? The spray of the water is just little droplets floating above the water and hitting you in the face and on your body and on your arms and it feels so cool. And the blown spume. What is spume? Windy? Windy what? Blown spume. Interesting.  What do you think? Spume? Salt? Well, exactly what is it? A splash? It deals with that but of what? Spray? And also in the water you have the water crashing up against the boat. The boat going through the water. The rudder drifting the boat along. What happens with as the boat makes its way through the water?  Why do I go like this with puff cheeks? Why? Right. Indicate spume. The foam, right? Sort of like foamy. Very interesting about the poet chose that word. Blown. He could have said floating but no. When it comes to foam he chose the word blown spume. Blown spume. That's the blown spume. Awesome. You can almost taste it, the foam. And that's the idea. I can do it in sign language just as you can but when it's written through words that will live forever. It's fantastic what poems attempt to do. Let's read the third verse now. Now listen.  Each one is linked with a sense of the man. Not the five senses but the five senses here on your hand plucking the strings and hearing it and tasting it and seeing it. Something like that. Now which does this appeal as far as a sense of sound when you read? Read the third verse and tell me how does it appeal to the sense of sound? Well read the whole line. What is like a wetted knife? What? What is like a wetted knife? What? The wind. The wind, correct. Equals a sharp knife. The wind flapping the sails and the sharp knife. Sometimes they're both very cold. When you're sailing and the sails up, you're blocked from the sun and there's no sun because you're under the sail. The sun's on the other side of the sail. So you're blocked from the sun. Do you stay warm? No, you're rather cold. Have you had that experience? And you start feeling the wind. It strikes you. Now, interesting to hear the wind. What letters of the A, B, C, D try to allow you to hear the sound of the wind, correct? The W. Count how many Ws are in that one line where the six, six W sounds to the whale's ways and the gull's way where the wind has a wetted knife. The whale's way, gull's way, like a wetted knife, a W sound. Again, you get a sense of the wind. The poet chooses those words very carefully to influence your sense of sound, strumming the liar, hearing the W again and again. You get the idea, alliteration. It's an important word that we learn. In mathematics, you have to learn certain words, what is meant by, for example, parallel lines. You have to learn what we mean by concentric circles. You have to learn those special terms in math, right? In engineering, in medicine, right? And the same thing with the study of lit, the study of poetry. There are certain words that are used often. Alliteration is one of those. Sometimes they use the G sound, the gu sound. It sounds rough. Other times, you use the L sound, the la la la la. It's a beautiful sound.  It's a lullaby, lullaby with the L sound. And it's a special sound. And if you repeat that sound over and over again, it has a strong effect on the hearing, on the sound. So watch for examples of that, of when poetry tries to use alliteration to see why they chose that special sound. Why? Time is up. So on Wednesday, we will continue the study of lyric, and I'll ask you many more questions when it comes to the discussion of imagery.


Hi everyone, this is Nithya Ruff and I'm very excited to be here with you at Foss Asia. I wish I could be there in person in Singapore, but given the circumstances, I'm speaking to you on a pre-recorded session. I want to talk to you about contributions and importance of contributions and going beyond just code contributions because we need all kinds of contributions and we need to recognize all kinds of contributions. I work for Amazon. I had the open source program office at Amazon and I also sit on the board of the Linux Foundation and I'm coming to you from North America, from Raleigh, North Carolina. So let's just get started in talking about this topic. One of the first things we need to talk about is why are contributions important? Why does free and open source software rely on contributions? And the important thing to see here is that when you have a common asset that all of us use and we help, we use it to innovate, we use it to develop products and services, etc., we need to then give back to it so that it can continue to grow and sustain. In fact, open source relies on people contributing back to open source in order to continue to improve, to grow, to strengthen, to thrive and to sustain. So it is such an important element of the open source growth, if you will, and success. The second thing would be that when more people contribute than everybody benefits and everybody learns and everybody grows from this and it lifts all boats. When only one person is burdened with improving something, we don't get the benefit of all of the brilliant thinking around the world and the brilliant talent and superpowers from around the world. The third thing is open source gives us a great way to get involved in tech and contribution to me is an on-ramp to starting to get involved in open source and tech. So contributions are important and it's a very core part of open source. But when you think about contributions, often you only think about code and you say, hey, in open source, I need to be technical, I need to be a programmer, I need to code, I need to only contribute code and they only accept code contribution. I need to do a pull request, a patch, etc. And code is extremely important. Don't get me wrong, code is very important because programs and projects have to grow and improve and become bigger. But there's a lot more to open source than just code. The culture of open source and the success of open source requires so much more than just the program of the technology that we all contribute to. There's so many other ways to contribute to open source. I would say the success of a project, the success of certain technologies depend upon all of these other elements working and being successful in order to really grow and be adopted in open source. One of the first things I would say is governance. So there are a lot of great people who have established projects before, have set up foundations, have managed at companies, etc. And they come with this leadership experience, this experience of how to set up the right group, if you will, governance, leadership, decision making, etc. for an organization. And most projects require that. They will start as they grow and become more and more successful. You have more people involved and you need to make sure that it is a fair and well run organization. So people with governance can contribute and help projects establish proper governance and that is a skill in itself. Let's then move on to establishing a community. So good programs and projects have users, they have people who contribute code, their committers, their maintainers, their community leaders, etc. And certainly financial folks and other elements in the project. And all of these volunteers, these are volunteers most of the time, need to be managed, need to have a cohesive sense of belonging to a common vision mission and a common purpose and need to know how to interact, how to communicate, how to work with each other and be recognized, be valued, etc. So the whole aspect of community building and community development and community management is such a big, big part of especially growing projects. So community leaders are much, much needed. So if you have skills in that area, it's a great place to get involved. And most projects require a lot of legal help also beyond just the license and the use of the license to, you know, access the code to a contribution license agreement in to make the contribution to trademarks to patent issues to, if you will, copyrights and branding. And there's a lot of legal stuff involved even in open source. And getting that right is important. And there are some brilliant people out there who balance understanding community with understanding legal nuances and their contribution to open source is incredibly valued and valuable. And one of the easiest ways, frankly, to get involved is to be a user. If you start using a certain project, why not go talk about it, file an issue, get involved in user groups, help other users. And there's just such a nice way to get involved in some technology from the user perspective. And these communities need that user perspective as well. We often tend to think of open source as not marketing friendly. And I have to say, advocacy or marketing is an important element of growing open source projects in the millions and millions of repos that often sit on GitHub or GitLab. Only way to be recognized and to kind of break out of that pack, if you will, is if you have a good outreach, a good advocacy and marketing program for the project. And I don't have to tell you that documentation is an extremely important element whether for users or for contributors. And we need translation so that projects can be global. Mentorship in a project is extremely important for new contributors and existing contributors. I think I covered evangelization in advocacy, but talking about it and everybody supporting it and talking about it broadly, whether it's on social media or any conferences is extremely important. So as you can see, code is important. Once you create that code, you need all of these surrounding elements in order for a project to be successful. And there are many, many benefits, I think, to individuals who get involved in open source. As we talked, it helps you get into tech if you're not in tech. It then gets you a job. Many of us have careers in open source because we develop skillsets working as a contributor in many open source projects. You get a tremendous amount of feedback and learning from others globally, not just in your own organization. And there's a sense of purpose and community when you're an open source because you feel like you are part of this bigger movement. And it's a positive and a good movement.  And that's a really good feeling. Companies benefit tremendously also from giving to open source, contributing to open source. And they do it in many, many different ways. They let their people work in open source. They contribute money through to foundations, sponsorships, cloud credits, et cetera, and sponsor events or host events in their venues. All of it is important, but it also has very good business benefits to companies to contribute. You reduce technical debt so you're not carrying and developing your products on something that's not on the mainline code and hence misses out on all the innovations and the security fixes, et cetera. You can influence the direction of a project through the code that you contribute. You can earn trust and a seat at the table of a project by contributing, by showing you care, by providing support to the project. And frankly, you sustain open source, which is one of the big innovation engines for all of us in all companies. And so supporting that and sustaining that is good for everyone. And many engineers and companies have said that they love the feedback that they get from a broader community of people, not just people in their team. And a company that has a good open source contribution profile and is a good citizen in the community often has a better job or easier time of acquiring talent and retaining talent because people want to work for companies that are in open source that allow their developers to work in open source. How do you increase contributions? I think companies can do a lot through establishing an open source project office, a program office like the kind I lead, which then makes it a point to help developers work in open source, make it easier to work in open source, clear their legal hurdles, clear the process hurdles. We recognize engineers who work in open source. We help teams set aside time for doing it. We mentor teams. But on the community side, also projects and programs can do a better job of making it dead easy for people to join as contributors, give better documentation, have a better community, have getting involved guides, easier licenses to work with, et cetera. I'm also seeing universities do a good job of developing curriculum. You have University of California Santa Cruz, you have Johns Hopkins and others and RIT who are creating curriculum and encouraging students to get involved in open source. But the most important thing is local communities like Claus Asia, which can make it safe, make it easy, make it familiar and comfortable for people to get involved in open source. And recognizing contributors, some of the best organizations I know, which do a great job of recognizing contributors are the Cloud Native Compute Foundation recognizes non-code contributions like they call it the Chop Wood and Fetch Water Award for all of those other things a project needs. The Apache Software Foundation does a fantastic job of including non-coders as members in the organization because of their contribution to the culture or to fundraising or to marketing, et cetera. And then the O'Reilly community awards, I'm very proud to be an O'Reilly community award winner, also recognizes community contributions and not just coding contributions. So with that, I want to draw your attention to some resources that you can read that will give you a sense of other things you can do to contribute and why you need to contribute, how to get involved, et cetera. Thank you so much for your time. And I hope that you have a really good time at Foss Asia. It's a fantastic program and fantastic organization that focuses on local communities and building open source strengths and skill sets in local communities. I hope you'll consider getting involved in open source and contributing in many ways, not just thinking that you have to be a coder to contribute. You can bring any of your superpowers to open source and be a contributor. Thank you again. This is Nithya Ruff. You can follow me at Nithya Ruff on Twitter. And I look forward to hearing from you.


This is City For All and in this video we're gonna talk about the influence of history and nature on our city's appearance. Once upon a time I've got an idea that seems quite obvious, but on the other hand upon deeper analysis may turn out to a complete crock. The idea is that people consciously are not are trying to recreate in their modern cities the environment. They are used to living in since the days of tribalism. Those who are used to living in the forests still plant many trees in cities. And those who have long lived in the steppes or deserts are not afraid to beg in the sun. Let's take for example modern Germans whose ancestors lived in the middle of forests during the Roman Empire.  And there are hundreds and hundreds of streets like this. A tree is an obligatory element of almost every German street from the main avenue to a quiet residential street. And from this point of view sunny Italy is quite different. The nature and vegetation here are completely different and there are not so many forests. Accordingly people are accustomed to other landscapes which they reproduce on the streets of their cities. In the city centers the narrowness of the streets and the shade from the buildings protect from the scorching sun and in the newer districts perhaps it's the locals habit of heat. Of course in Italy you can also find shady streets with trees, but they are mostly ceremonial while dozens of ordinary streets look like this. The squares are often also solid stone without a single patch of greenery. The old ones and the new ones too. Another example is Switzerland whose inhabitants have long been accustomed to living among mountains and rocks with their gloomy majestic beauty. As a result Swiss cities also look very restrained and sometimes harsh. The streets are dominated by the gray color of natural stone and concrete and vegetation if any appears very sparingly as if it really grows on rocks. And the buildings around them often also resemble gray cliffs. So what do you think about it? Is there something in your cities that has its roots in the surrounding nature and ancient times and tell who we are? Is there anything similar in your cities now? My first thought was about using local natural materials in the decoration and plant characteristic of the local nature. But maybe this is too simple and banal and there is something deeper. What do you think? That's all for a moment. If you liked this video, please hit the subscribe button and leave your comments and also visit our Patreon page where you can support our channel. See you in the next videos!


Live from San Jose, California, it's theCUBE. Covering Big Data Silicon Valley 2017. Okay, welcome back everyone. Live in Silicon Valley, this is the CUBE coverage of Big Data Week, Big Data Silicon Valley, our event in conjunction with Strata Hadoop. This is theCUBE for two days of wall-to-wall coverage. I'm John Furrier with analysts from Wikibon, George Gilbert, our Big Data, as well as Peter Burris, covering all the angles. And our next guest is Wei Wang, Senior Director, Product Marketing at Hortonworks, a CUBE alumni, and Oliver Chu, Senior Product Marketing Manager for Big Data and Microsoft Cloud at Azure. Guys, welcome to theCUBE, good to see you again. Welcome on theCUBE, appreciate coming on. Thank you very much. So Microsoft and Hortonworks, you guys are no strangers. We've covered you guys many times on theCUBE, HD Insights. You have some stuff happening here.  So you have something happening tomorrow, a blog post going out, what's the news with Microsoft? So essentially I think that we are truly adopting the cloud first. And you know that we have been really acquiring a lot of customers in the cloud. We have that announced in our earnings that more than a quarter of our customers actually already have a cloud strategy. I want to give out a few statistics that Gardner told us actually last year, the inquiries for their end users went up 57%, just to talk about Hadoop and Microsoft Azure. So what we're here is to talk about the next generation. We're putting our latest and greatest innovation in which comes in in the package of the release of HTTP 2.6, that's our last release. I think our last conversation was on 2.5. So 2.6, great latest and newest innovations to put on cloud first. Hence our partner here at Microsoft. We're going to put it on Microsoft HD Insights. It's super exciting. And you know, Oliver, one of the things we've been really fascinated with and been covering for multiple years now is the transformation of Microsoft. Even prior to Satya, who's a CUBE alumni by the way, been on theCUBE when we were at Excel event at Stanford. So CEO of Microsoft, CUBE alumni, good to have that. But it's interesting, right? I mean, the Open Compute project, they donated a boatload of IP into the open source, heavily now open source. Brendan Burns works for Microsoft. He's seeing a huge transformation of Microsoft. You've been working with Hortonworks for a while. Now it's kind of coming together and one of the things that's interesting is the trend that's teasing out on theCUBE all the time now is integration. You're seeing this flash point where, okay, I got some Hadoop, I got a bunch of other stuff in the enterprise equation that's kind of coming together and things like IoT and AI is all around the corner as well. How are you guys getting this all packaged together? Because this kind of highlights some of the things that are now integrated in with the tools you have. Give us an update. Yeah, absolutely. So for sure, just to kind of respond to the trend, Microsoft kind of made that transformation of being cloud first many years ago. And it's been great to partner with someone like Hortonworks actually for the last four years of bringing HD Insight as a first party Microsoft cloud service. And because of that, as we're building other cloud services around in Azure, we have over 60 services. I'm gonna think about that. Paz and IaaS services in Microsoft, part of the Azure ecosystem, all of this is starting to get completely integrated with all of our other services. So HD Insight, as an example, is integrated with all of our relational investments, our BI investments, our machine learning investments, our data science investments. And so it's really just becoming part of the fabric of the Azure cloud. And so that's just a testament to the great partnership that we're having with Hortonworks. And so the inquiry comment from Gardner, and we're seeing some of the things on the Wikibon side on our research team, is that now the legitimacy, I say, of seeing how Hadoop fits into the bigger picture, not just Hadoop being the pure play big data platform, which many people were doing, but now they're seeing a bigger picture where I can have Hadoop and I can have some other stuff all integrating. Does that kind of where this is going from you guys' perspective? So yeah, it's again some statistics we have done tech validate service that our customers are telling us that 43% of the responders are truly using that integrated approach, right? The hybrid, they're using the cloud, they're using our stuff on premise to actually provide that integrated end to end processing workload. There now I think people are less think about, I would think a couple of years ago, people probably think a little bit about what kind of a data they want to put in the cloud, what kind of workload they want to actually execute it in the cloud versus their on premise. I think what we see is that line started to blur a little bit and given the partnership we have with Microsoft, the kind of the enterprise ready functionalities and we talk about that for a long time, last time I was here, talk about security, talk about governance, talk about just layer of integrated layer to manage the entire thing, either on premise or in the cloud. I think those are some of the functionalities or some of the innovations that make people a lot more at ease with the idea of putting the entire mission critical applications in the cloud. And I want to mention that, especially with our blog going out tomorrow, that we will actually announce the Spark 2.1 in which in Microsoft Azure HD insight, we're actually going to guarantee 99.9% of SLA, right? So it's for that, it's for enterprise customers in which many of us have together that it's truly an insurance outfield that people are not just only feel at ease about the data that were they going to locate, either in the cloud or within their data center, but also the kind of speed and response and reliability. Yeah. Oliver, I want to cue off something you said, which was interesting, that you have 60 services and that they're increasingly integrated with each other. The idea that Hadoop itself is made up of many projects or services. And I think in some amount of time, we won't look at it as a discrete project or product, but something that's integrated with a, that together makes a pipeline, a mix and match. And I'm curious if you can share with us a vision of how you see Hadoop fitting in with a richer set of Microsoft services where it might be SQL server, it might be streaming analytics, what that looks like. And so the issue of sort of a mix and match toolkit fades into a more seamless set of services. Yeah, absolutely. And you're right, like Hadoop and Wei will definitely reiterate this is that Hadoop is a platform, right? And certainly there is multiple different workloads and projects on that platform that do a lot of different things, right? You have Spark that can do machine learning and streaming and SQL like queries. And you have Hadoop itself can do batch, interactive streaming as well. And so you see kind of a lot of workloads being built on open source Hadoop. And as you bring it to the cloud, it's really for customers that what we found and kind of this new Microsoft that's often talked about is it's all about choice and flexibility for our customers. And so some customers want to be 100% open source Apache Hadoop. And if they want that, HTN sites the right offering. And what we could do is we can surround it with other capabilities that are outside of maybe core Hadoop type capabilities. If they want to do media services all the way down to other technologies that nothing related to specifically to data and analytics. And so they can combine that with a Hadoop offering and blend it into a combined offering. And there are some customers that will blend open source Hadoop with some of our Azure data services as well because it offers something unique or different. And but it's really a choice for our customers. Whatever they're open to, whatever their kind of their strategy for the organization. Is there just to sort of then compare it with other philosophies. Do you see that notion that like Hadoop now becomes a set of services that might or might not be mixed and matched with native services. Is that different from how Amazon or Google, you know, you perceive them to be integrating Hadoop into their sort of pipelines and services? Yeah, it's different. Cause I see Amazon and Google, like for instance, Google kind of is starting to change their philosophy a little bit with introduction of Dataproc. But before you can see them as an organization that was really focused on bringing some of the internal learnings of Google out into the marketplace with their own, you can say proprietary type services with some of the offerings that they have. But now they're kind of realizing the value that Hadoop, that patchy Hadoop ecosystem brings. And so with that comes the introduction of their own managed service. And for AWS, you know, they're kind of their roots as I as sort of speak is kind of the roots of their cloud. And they're starting to bring kind of other systems, very similar to I would say Microsoft strategy. For us, we're all about making things enterprise ready. So that's what the unique differentiator and kind of what way kind of alluded to. So for Microsoft, all of our data services are backed by 99.9% service level agreement, including our relationship with Hortonworks. And so that's kind of one. Just say that again one more time. 99.9% of time. And if that were ever to SLA, and so if that's a guarantee to our customers. And so if anything were. One more time. It's a guarantee to our customers. This is important. SLA, I mean Google Next didn't talk much about last week, their cloud event, they talked about speeds and feeds. Exactly. Not a lot of SLA's. This is mandate for the enterprise. They care more about SLA's, so not that I don't care about price, but they'd much rather have solid bulletproof SLA's than the best price. Because it's a total cost of ownership. And that's really the heritage of where Microsoft comes from because we have been serving our on-premises customers for so long. We understand what they want and need and require for a mission critical enterprise ready deployment. And so our relationship with Hortonworks, absolutely 99.9% service level agreement that we will guarantee to our customers and across all of the Hadoop workloads, whether it be Hyde, whether it be Spark, whether it be Kafka, any of the workloads that we have on H&M site is enterprise ready by virtue, mission critical, built in, all that stuff that you would expect. Yeah, you guys certainly have great track record enterprise, no debate about that, 100%. Back to you guys, I want to talk about a step back and look at some of the things we've been observing kicking off this week at Strata Hadoop, since it's our eighth year, covering Hadoop world now. It's been evolved into a whole huge thing with big data SV and big data NYC that we run as well. The vets that were made. And so I've been intrigued by HD insights from day one, especially the relationship with Microsoft's, got our attention right away because of where we saw the dots connecting to which is kind of where we are now. That's a good bet. So we were looking at what bets were made and who's making which bets when and how they're panning out. So I want to just connect the dots. The bets that you guys have made, the bets that you guys have made that are now paying off. And certainly we've talked before camera, revolution analytics, obviously now looking real good middle of the fairway, as they say. Bets you guys have made that you're good. Hey, that was a good call. Right. And I think that first and foremost, we as Hortonworks to support machine learning, we don't call it AI, but we are probably the one that first to put always put the spark, right? In Hadoop, I know that spark has gained a lot of traction, but I remember that in the early days, we are the ones that as a distro that going out there, not only just verbally talk about support of spark, truly put it in our kind of distribution as one of the component. We actually now in the last version, we are actually allows also flexibility. You know spark, how often they change. Every six weeks they have a new version. And that's kind of in the sense of running into paradox of what actually enterprise ready is. The enterprise within six weeks, they can't even roll out entire process, right? If they have a workload, they probably can't even get everyone to adopt that yet within six weeks. So what we did actually in the last version which we'll continue to do is to essentially support multiple versions of spark, right? We essentially to talk about that. And the other batch we have made is about Hive. We truly made that as a kind of initiative behind project stinger, stinger initiative and also have tasks and now with LAP. We made that effort to joining with all the other open source developers to go behind this project that make sure the sequel is becoming truly available for our customers, right? Not only just affordable, but also have the most comprehensive coverage for sequel and C2011, but also now having that almost sub-second interactive query. So I think that's the kind of batch we made. You got the compatibility sequel, then you got the performance advantage that are going on in this databases where it's in memory or SSD. That seems to be the action. Oliver, you guys make some good bets. So let's go down the list. Yeah, let's go down the memory lane is, and I always kind of want to go back to our partnership with Hortonworks is we partnered with Hortonworks really early on in the early days of Hortonworks existence. And the reason we made that bet was because of Hortonworks strategy of being completely open, right? And so that was a key decision criteria from Microsoft that we wanted to partner with someone whose entire philosophy was open source and committing everything back to kind of the Apache ecosystem. And so that was a very strategic bet that we made. It was bold at the time too. It was very bold, yeah, at that time, yeah. Because Hortonworks at that time was a much smaller company than they are today, right? But we kind of understood where the ecosystem was going and we wanted to partner with people who were committing code back onto the ecosystem. And so that I would argue is definitely one, one really big bet that was a very successful one and it continues to play out even today. Other bets that we made like we talked about prior is our acquisition of revolution analytics a couple of years ago. And that's playing out as well. It just keeps on rolling, it keeps on rolling. Rolling, rolling, it's awesome. All right, final, where I just want to get an update on the data science experiences you guys have. There's your any update there, what's going on, what seems to be the data science tools that are accelerating fast? And in fact, some are saying that it looks like the software tools years and years ago. So a lot more work to do. So what's happening with the data science experience? Yeah, absolutely. And so just tying back to that original comment around our revolution analytics, that has become Microsoft R server. And we're offering that available on-premises and in the cloud. So on-premises, it's completely integrated with SQL server. So all SQL server customers will now be able to do in-database analytics with R built into the core database. And that we see as a major win for us and a differentiator in the marketplace. But in the cloud and in conjunction with our partnership with Hortonworks, we're making Microsoft R server available as part of our integration with Azure HD Insights. So kind of just tying back all that integration that we talked about. And so that's built in so any customer can take R and paralyze that across any number of Hadoop and Spark nodes in a managed service within minutes, clusters will spin up and they can just run all the data science models and train them across any number of Hadoop and Spark nodes. And so that is a- That takes the heavy lifting away on the cluster management side so that the focus on their job. Absolutely. Awesome. Well guys, thanks for coming on. We really appreciate your way with Hortonworks. And we have Oliver Chu from Microsoft. Great to get the update. And tomorrow at 10.30, the cloud first news hits. Cloud first, Hortonworks with Azure. Great news, congratulations. Good cloud play for Hortonworks. The Cube, I'm John Furrier with George Gilbert. More coverage live in Silicon Valley after this short break.


Yeah, it's on the 3002. Right, direct through Raven, down to 11000 and 3002 on the meter. American at 123.633 left. Traffic, 7 o'clock, same altitude, 0-1. Start 1-2, thank you. Direct down. Working here shortly, reference to traffic. Good flight. Good. That will make Malibu 927, Romeo. That's a good position here, and right now for us. We're at 27000, contact 3225. We're going to 040 at 124.65. We're at Captain 32, but we have contact with Braves and, you know, at 0-2, Red, Red, Green. Just in the maintain, 3 down. 3 down the mountain. In target 12, proceed to the right, Red, Green. 2, 2, 2, 3, 3, 3, 3, 4, now you're to guard. He's up here. We're just traffic, we're 0-1 to 0-1, 2-9. There he is. Copy, 23931 is right down within the field. We're landing 35 summit. Summit cap 2526, 26 is at the endpoint, we're on number one, let us know we can maneuver to guard point number two. Summit approach, cap 2526.


Introduction fetal heart rate, FHR, monitoring is a vital aspect of fetal well-being assessment, and the current method of computerized cardiotography, CCTG, is limited to the hospital setting. Non-invasive fetal ECG, NIFEC, has the ability to produce FHR patterns through a wave detection while eliminating confusion with maternal heart rate, but is presently limited to research use. Femmem is a novel wireless NIFEC device that is designed to be placed without professional assistance while connecting to mobile applications. It has the ability to achieve home FHR monitoring thereby allowing more frequent monitoring, earlier detection of deterioration, while reducing hospital attendances. This study aims to assess the feasibility, reliability, and accuracy of Femmem NIFEC by comparing its outputs to CCTG monitoring. Methods and analysis this is a single centered prospective pilot study taking place in a tertiary maternity unit. Women with a singleton pregnancy over 28 plus zero weeks gestation who require antenatal CCTG monitoring for any clinical indication are eligible for recruitment. Con. This article was authored by Amanov Bidey, Bhasky Filignathan, Becky Liu, and others. We are article.tv, links in the description below.


Defendant. In a criminal case, the defendant is the person who has been charged with the crime by the government. In a civil case, the defendant can be a person, a business, or a government agency that is being sued for doing something wrong.


Thank you for coming on a Friday afternoon, no less. My name is Maya Levine, and today's talk is going to be about identity security. The name is I Am Confused. And so I have a question for you all. When it comes to identity, are you confused? If you are, it completely makes sense, because things are so complicated and evolving so quickly. Identity in the cloud is a relatively new frontier. But it is essential and non-negotiable to be investing in it and getting it right. Identity is like the perimeter of the cloud. And almost every cloud breach that we've seen in the past few years has taken advantage of mismanaged permissions, secrets, and identities. As an industry, we are struggling when it comes to identity management, especially when it comes to how many permissions we're granting versus actually using. Cystic threat research found that 98% of permissions that are granted are actually unused. And that's a huge scope for an attacker to take advantage of, especially considering a lot of us are utilizing default roles, which generally have a lot of permissions granting to them, versus creating our own custom specific roles. And there's quite a few challenges with identity security, including the fact that ownership of identity posture between dev ops and security is often unclear. And this can lead to mistakes that stem from going too fast. In addition, human and machine identity management is not easy. I really like the metaphor of a key under the mat. If I'm a robber and I'm scoping out your house and I notice you're gone on vacation, the first place I'm going to look is somewhere like under the mat where I know people tend to leave their keys. Similarly, attackers are very good at secret harvesting. And they know where to look. And this is everywhere from serverless function code, IAC software, things like Terraform state files. They often contain credentials and secrets and otherwise sensitive information that gets overlooked because they're kind of obscure.  Credentials are being left everywhere from repos to GitHub to AD to Slack. And developers can underestimate the power of read-only access. That's all attackers need in order to read a secret. The point here is that attackers are actually better than we are at secrets management because for them, getting a credential with great access is their golden ticket. It's what will enable them to escalate their privileges and escalate their attacks. While for defenders, this is usually not the highest priority item. And humans make mistakes. As a kid, I used to watch this show with my grandmother with this kind of scary British lady. And I now think of it as that humans are actually the weakest link in any cybersecurity posture of an organization. And this is matched by the statistics. Social engineering is a part of 98% of all cyber attacks. Verizon reported that 82% of breaches are caused by some kind of human error. And specifically for identities, MFA abuse actually works really well through social engineering. And I'll talk about that in a few of our examples. Probably the most difficult challenge is just the speed at which attackers can move in the cloud. The average cloud attack takes 10 minutes. So when you think of how long you have to both detect, correlate these signals and initiate some kind of response, you need to be moving at this type of speed, which obviously is challenging. For identities in particular, we can really use that information to help with correlation.  So, for this presentation, I want us to learn from things that we've actually seen in the wild. All of the attacks that I'm gonna go through here were either real breaches affecting organizations or were caught on honeypots by security threat research teams. So these are all techniques that attackers are actually using. And for this first attack, I think it's a really great example of how humans make mistakes, and that's very understandable, given how easy some things are to miss in the cloud. This attack started with attackers looking at Jupyter Lab notebook containers that were deployed in a Kubernetes cluster, and they exploited vulnerabilities on those to get their initial access. From there, they utilized scripts to search for AWS credentials in a bunch of locations, including instance metadata, docker containers, and file systems. And they're using tools like AWS CLI and PAKU to try to get access to more credentials. And they actually exploited vulnerabilities in IMDS v1 to successfully get credentials. With those credentials, then they moved into the reconnaissance part of their attack. So here, they're looking at what can I access with the credentials I already have, and what other credentials can I get access to? And they were able to create new users and access keys because of a small mistake that most CSPM tools would not catch. So it can be really hard to keep track of the various rules in cloud service providers. One example is what is case sensitive or case insensitive. When it comes to AWS policies, the action part is case insensitive, but the resource part is case sensitive. And you can see here, the victim described a restrictive policy where they had admin with a lower case A. But then they accidentally created a user that had an upper case A. Maybe it was a typo, maybe they just didn't know about the case insensitivity. And that was the user that the attacker used to take advantage of and create access keys with admin permissions. So this is a great example of people really trying to do the right things. They had a restrictive policy to try to limit the ability to create an access key, but one small typo kind of ruined it for them. With their permissions, the attackers were then able to create access keys for a bunch of users, run EC2 instances with crypto miners and steal data. So some takeaways from here, least permissive is not just a buzzword. It is imperative that we are looking at the permissions that we are granting and narrowing the scope to what is actually necessary. It's also really important in your organizations to identify who is the clear owner for IM, for CIM, for however, whichever acronym you wanna be using. And it doesn't matter who it is, right? It could be your infrastructure team who's actually deploying the resources, your IT team, your security team. What's important is that they know that they are responsible for catching things like case sensitive mistakes and other things that are a little more tricky and require a little more thought into implementing correctly. Now the second attack is really a compilation discovered by the Cystic Threat Research Team of different patterns in attacker playbooks that we've seen attackers doing in the cloud. So most attacks begin with some kind of initial compromise by getting credentials either from open buckets, GitHub, or public repositories. And then they do enumeration in the cloud, looking for resources, looking for more credentials. And it's important to not overlook things like terraformed state files and serverless function code because attackers are targeting those things and looking for credentials stored there. So whoever the clear owner of IM is in your organization should be looking at these spots as well. Where possible, they'll abuse policy misconfigurations in order to get to their end goal, which is often profit driven. They'll deploy crypto miners, but sometimes it's not profit driven. So they can target existing resources and for example, connecting directly to an EC2 instance and use them as a jump box to launch more attacks. When we think of lateral movement, often we think of moving from one account in the cloud to another, but we witnessed an attacker move laterally from an enterprise cloud account to the compute infrastructure, in this case EC2. And from there, attackers can pivot to on premise servers if the servers in the cloud are connected to them. So here the attacker leveraged an API called send SSH public key to gain access to the EC2 instances. So they pushed an attacker supplied SSH key and then anyone that had access to that key could connect via SSH. Now this type of lateral movement can cause issues for defenders because it often involves crossing a detection boundary. When you go from AWS into EC2, CloudTrail will no longer provide the information about what the attacker is doing. So defenders need to monitor both the cloud control plane APIs like CloudTrail and your EC2 workloads at runtime in order to understand the full scope of the attack. It's important to understand how your cloud accounts and your on premise accounts are connected and you can't just assume that they are isolated. We've seen in more than one attack where they pivoted either from on premise to cloud or vice versa. Employing a secrets management system will reduce your likelihood of having a credential leak. So you wanna keep your credentials and your keys in a centralized location, provide an API to dynamically retrieve those keys and make sure that those keys and credentials are not gonna be inadvertently left in files. And a CSPM solution is needed in order to harden and prevent the misconfigurations that attackers will take advantage of. But you also need runtime security to be able to detect things at real time. So you want to apply to both cloud logs and activity that's occurring on your compute resources in order to track an attack like the one I just went over. In the next attack I'll go over, I think it really highlights what the dangers of overly permissive allowing overly permissive for things like IAC services. So here the threat actor used a well-known VPN service called CyberGhost to hide their source IP and they use the assume role API to obtain additional privileges and continue going through the kill chain. So with those powers they began enumerating inside the cloud account looking for interesting information and they were able to join a group that had special privileges in cloud formation. So here they called the API create stack and they tried to add a cloud formation template called and I kid you not evil template. So they didn't really hide the intention there very well. But here was a case where it wasn't overly permissive. The credentials that they had access to did not allow them to actually run this malicious template. So the victim here kind of got saved. So the takeaways for me here are first, you can't secure what you don't know about. So this is especially true in the cloud given the dynamic nature of resources. You want to have an inventory of all of your cloud assets and this includes Lambda functions and policies with security statuses. Second is you need to think about how to implement IAC security. So both in terms of detecting your drift and how you can shift your security checks using IAC templates as early into the developer pipelines as possible. This is both for misconfigurations of controls and other things. And finally, real-time threat detection across your runtime workloads and cloud. I mentioned this already, but it's important to emphasize that threat detection needs to be real-time. If a cloud attack takes 10 minutes to execute, you don't want to know about an event 10 minutes or more later. And you want the visibility in both runtime workloads and in the cloud logs. For the next attack, I think this is an example of social engineering at its finest. So here, the attack began with a criminal group known as Scattered Spider and they targeted MTM Resorts International which is a global hospitality and entertainment company. They looked through LinkedIn for users that they thought would have high privileges in Okta and tried to take advantage of password reuse here. Once they got credentials, then they utilized them to gain access to MGM's environment and establish a foothold. So they actually successfully tricked the help desk with voice phishing into resetting a user's MFA and that's what granted them deeper access. And the kind of access they got is the stuff of nightmares for most of you in this room. They configured an additional identity provider within MGM's octa-tenant using inbound federation and that allowed them to have persistence in the network. If you see these three types of admins that they had, this is not good access that you want attackers to ever get in your environment. With that kind of access, they very easily were able to pivot onto the VMware infrastructure of MGM and deploy ransomware on the ESXi servers. And here they actually called in another criminal group called Black Hat in order to deploy that ransomware. So as if we didn't have to worry about just attackers themselves, know that ransomware as a service is a big part of the criminal industry and even if attackers don't have the technical chops to implement it themselves, they can always just call somebody else in to do that. The impact here was huge. It affected things, services like hotel room keys, dinner reservation systems, point of sale systems, slot machines, which if you've ever been to Vegas, I'm sure you know is a huge selling point for profits there. And though the incident response team ended up terminating the octa-sync servers once they realized what was happening, the impact was already huge, estimated at around $8 million a day in financial losses. So there's a lot of takeaways on this one. The first is that you can't synchronize your credentials between your on-premise and your cloud resources. This opens up a lot of attack vectors. The worst part of this breach was that MGM's IDP was configured in a way that allowed scattered spider to pivot into their VMware infrastructure, and that's where the ransomware was deployed. IDP admin accounts need to be managed with the highest level of scrutiny possible. So always check a user's device and compliance before allowing them access to your IDP and enforce dual access wherever possible. As I mentioned, ransomware as a service is a big business. It's something to just be aware of. And here, MFA device reset, this was a significant choke point in the attack. So if they limited MFA to a specific phone number, none of this attack could have happened. You also maybe want to alert on any MFA device changes and have multiple authorizations for critical actions. In the next attack, I think this is a really cool example of how attackers can establish persistence while not being noticed and really blending in very well. So here, the attacker gained access through a misconfigured Kubernetes API server that allowed unauthenticated requests from anonymous users with privileges. They sent HTTP requests to list secrets, API requests to try to gather information about the clusters, and they actually attempted to delete deployments in various namespaces to disable competitor campaigns. And then they established persistence using RBAC. So what they did is they created a new cluster role with admin privileges, and then they created a service account that they called the cube controller in the cube system namespace. And then they created a cluster role binding that bounds that cluster role to that service account for persistence. And here, they achieved persistence without setting off any alarms by blending in with the API audit logs. This looked like legitimate activity of a cluster binding. And at this point, even if the anonymous user access got disabled, they created a persistence that allowed them to further exploit the cluster. And that's exactly what they did. They utilized AWS access keys exposed in the cluster to go further into the cloud service provider account. And they deployed a container using daemon sets to run Monero crypto miners. And they used a container image from Docker Hub that was made to look like a legitimate Kubernetes IO account. So even though the image was eventually detected as a crypto miner, again, they're trying to blend in by naming it things that we're used to seeing. And when inspecting this image, we saw that it was pulled quite a few times. And there's a lot of evidence that this has been a very widespread campaign. So here, what started everything was a misconfigured Kubernetes API server that allowed the unauthenticated requests from anonymous users that had privileges. So I've mentioned least permissive. Again, I'm gonna mention it again because overly permissive is one of the biggest gifts that you can give to attackers. You can't always control how they get into your environments. I mean, for example, there's zero day vulnerabilities that we don't even know about that they might. But once they're in, if you're giving them just admin access and just kind of giving permissions like Oprah back in the day of like you get this and you get this, then you're gonna run into real problems.  If the victims here had Kubernetes audit detection policies in place, they could have detected the new cluster role creation and the cluster role binding. So you should build a system that will alert on things like these and add your exceptions of things like GKE automation. And it's worth mentioning that runtime analysis should have some element of machine learning to help you here. The standard way of detecting crypto miners is looking at known mining pool IPs or by the file name, if we know that it's a crypto miner. But you should have this kind of malware machine learning that can detect a crypto miner based off of CPU and memory and network activity. The next attack is a very great example of how hard coded credentials can be a gold mine for attackers. So here, the attacker gained access to Uber's IT environment by getting credentials to their VPN infrastructure from the dark web. So that's another source of credentials for attackers. They will get from where they can find their credentials. Some of them will sell it to other attackers on the dark web. And then they use those compromised VPN credentials to repeatedly attempt to log in. Every time they tried, this generated an MFA notification. And so then they reached out to the contractor on WhatsApp, pretended to be part of Uber's IT support, to encourage them to accept. And when they finally did, the attacker had access to the Uber VPN. From there, they found a network share that contained a PowerShell script that had hard coded credentials to Uber's Privilege Access Management or PAM solution. Worst case scenario, everybody. That really, really just is the type of hard coded credentials that I'm sure when they found it, they did a little dance because it's a gold mine for them in what they wanted to do. And those credentials were not rotated in a long time. That makes exploiting them much easier. Using those credentials, they authenticated to the service and they accessed secrets from the PAM service. And if you look at that bottom row here, again, this is the type of admin access that you don't want anybody outside of your organization to ever have. And with those elevated permissions, they were able to compromise critical company systems, including SSO and consoles and cloud management that stored sensitive data. And it wasn't very hard for them to then exfiltrate data. So they downloaded internal Slack messages and information from a finance tool that Uber's finance team did and exfiltrated that data out. So here, a big takeaway is that while MFA is definitely required, it might not be enough. Don't think that if I have MFA, check identity security complete. And the biggest takeaway here is that hard-coded and embedded credentials pose a huge risk to your organizations. It was the harvesting of those hard-coded credentials that gave them access to the PAM solution, which gave the attackers the keys to the kingdom to wreak havoc inside of Uber's IT environment. So I suggest potentially, if you don't have the capacity to find all of the hard-coded credentials or to find credentials that you inadvertently left in files and all of that, you can turn to third-party services. There are bounty hunters that that is their job to look for these kinds of exposed credentials. And wouldn't you rather have them notifying you about it rather than a breach happening in your environment? Now, employee education is so important. If people can be tricked into clicking on a phishing link in an email, they can certainly be tricked into accepting a push notification from their own employer's MFA application. So the more you educate your employees, the less risk that you're gonna have of this kind of social engineering working. And identity hygiene is its own kind of branch in CIM tools, but a big part of that is that you need to rotate your access keys. AWS actually suggests rotating it at least every 90 days. Now, in this next attack, we are gonna look at what makes storage resources more vulnerable to things like ransomware attacks and data exfiltration. So here, like many attacks, the attack started with an initial compromise of a long-term credential. And then they did reconnaissance and they're trying to find other users and buckets and available keys. Here, we saw them actually, the Cystic Threat Research Team saw them making calls to the AWS Simple Email Service, or SES. And we have found that SES is actually a very interesting attack vector that we're seeing more often for threat actors for phishing. From there, they tried to create persistence by creating additional users with names like Root and Admin. And finally, they moved on to the data exfiltration part. So the first thing they did was they checked the versioning on S3 buckets. If you have versioning enabled, it allows you to easily restore data if it was deleted. And in this case, versioning was enabled, so they disabled it. And then they were able to exfiltrate data out of the S3 bucket, delete that data, and leave a ransomware note on the S3 bucket itself. And this was actually detected through AWS billing because the victim here happened to not have cloud trail enabled on this environment. So when you have a data leaving an AWS bucket, this incurs an egress cost, and that's actually how this whole attack was confirmed. So for this attack, the takeaways are that you should be utilizing cloud trail or the equivalence in Azure, GCP, or whichever cloud service provider you have for storing data for detections. And you can store data in S3 buckets that allows for longer data retention and consider enabling cloud trail for data events, but be very selective about where you do that. Only do it where your most important data is stored because it can generate a lot of events, which obviously can be very expensive. Where you can, you should be employing IAM roles instead of long-term access keys to minimize the risk of credential abuse. So audit your access keys, ensure they're not publicly accessible, and regularly rotate them as well. And things like disabling bucket versioning and deleting data are the kinds of actions that should be behind MFA. This is a case where they had versioning enabled, but the attacker was very easily able to just change that setting. Now, the last attack we're gonna talk about, I saved for last because I thought it was one of the more creative out-of-the-box things that I've seen attackers do in the past few years. This was reported by Microsoft. They called it Strawberry Tempest and it involves a criminal group called DEV0537. Here, they employ a ton of different methods to compromise user identities. Everything from foam-based social engineering and sim-swapping to insider threats. They went so far as to post ads in telegram channels saying we are looking for insiders to provide us credentials for VPNs or credentials that can access the network and we will pay you if you give that to us, which I think is a little cheeky to post it in a public telegram channel. The dark web, they use password stealers and they looked at exposed credentials in public repos. So pretty much every possible method of initial compromise of identities, they were employing here. And once they did compromise identities, they did research on those people to try to find things that they could then answer if security questions came up. After gaining their initial access, the group then conducted reconnaissance to try to get more credentials and more intrusion points. They used tools like AD Explorer for enumeration and they escalated their privileges by exploiting vulnerabilities in servers like JIRA and GitLab and Confluence. They even convinced help desk personnel to reset credentials by having English speakers call in and then answer questions like, what is your mother's maiden name? What street did you live on? So it's clear that they had done a lot of research in that initial compromise section. And they exfiltrated data using dedicated infrastructure. So they chose VPN egress points in the same environments as their targets to avoid being caught on things like impossible travel. They exploited cloud tenant privileges to create admin accounts, manipulate email transport rules, and delete other admins. And here's what I thought was just very creative. They deleted resources to trigger incident and crisis response processes and then they joined the crisis communication calls to spy on and understand what is the incident response workflow of this organization and how can I initiate my extortion. So many takeaways on this. First of all, require trusted endpoints. Nowadays, we work on our phones, we work obviously on our laptops, mandate the use of compliant and healthy devices. That will kind of eliminate some of the ways that they were able to exploit credentials in that first phase. Leverage modern authentication for VPNs. So use things like OAuth or SAML that is connected to Azure AD for VPN authentication in order to enable risk-based sign-in detection and just a tighter integration for risk detections. And establish operational security processes. First of all, check who's on your incident response calls and make sure they're part of your organization and are supposed to be there. Definitely keep your resource plans closely held and not easily accessible to whatever incident response plans you have in your org. So I went through a lot in this past 30 minutes. I will try to summarize some of the key takeaways. I think there's more than just what's on this slide. But advice to improve your cloud security, identity security programs will include certain tools that you should be investing in. So obviously CIM which is cloud, I think infrastructure and titles management. There's two elements that I see for this which is the least permissive part. So your tool should be able to tell you which permissions are excessive and weren't used based off of things like cloud trail logs as well as identity hygiene. Do you have MFA enabled? Are your access keys rotated and things like that? You should be implementing network segmentation in order to make it harder to move laterally for them. And be aware of your connections to on-premise resources here. And invest in some kind of cloud detection and response that can correlate that detection signals from both your cloud infrastructure and your identity providers. Your IDPs like Okta, if you can detect weird things happening there, that is an important signal in understanding the full scope of an attack. Now on the processes side, education and training is incredibly important. Forbes found that if you have some kind of training on phishing in your organization, then the amount of users who fall victim to social engineering scams drops from 32% to 5% after a year of training. So educating your employees, remember that humans make mistakes and that it's natural and understandable for them to, means that you should be investing in helping them not to fall for things. And shorten your session links for admin accounts in big SaaS apps and wherever you can, just make it so that admin permissions and admin actions that are really terrible have extra layers of security like dual authentication. And improve your MFA and your secrets management overall. So for MFA, require registration from a trusted location, limit it to potentially one device, alert on devices from unused location. And with secrets management as well, you should be investing in making that as secure as possible. So if you're saying I am confused, I want you to know that is a perfectly reasonable way to feel. It's a very difficult, tricky thing to get it right, but it is necessary. And I hope that if anything, the takeaway from this talk is that attackers are investing in identity and so should you. Thank you so much for your time. If you want to provide feedback, there's this QR code.


Good evening. This is Melissa with thestockswish.com and welcome. Welcome to a free lecture that I'm doing this Tuesday, October 1st. It's on profit easily with momentum. What a great topic. Good afternoon, everyone. My name is Melissa Armo and I own a company called the Stock Swoosh LLC. If you'd like more information on upcoming classes, go to my website at www.thestockswish.com. If you'd like more information on the upcoming webinar, email me at Melissa at thestockswoosh.com. You can also go to Twitter, Facebook, YouTube, LinkedIn, Pinterest, Skype, and like me at any one of these places. The free lecture is Tuesday, October 1st, first day of October. At 5.30 p.m. Eastern Time, all you have to do is go to this link here and register. Registration is free. Do you want to make a little bit of money or do you want to make a lot of money? Personally, when I decided I wanted to trade at the market, I had made the decision that the reason that I wanted to do this and the reason that I am doing this is because I want to make a lot of money trading. I never wanted to make pennies trading. I always wanted to make a lot of money trading. How? How can you make a lot of money in the market?  The answer is yes. It's about riding this wave of momentum. Do you want to ride the wave or do you want to watch it just go by you? Momentum equals money in the market. Learn how to make easy money in the market by trading on the side of momentum. Trading can be fun and effortless once you learn how to take positions on the right side of a move. Learn how to pick what stock will have a big move before the move has occurred. Profit by taking trades with the wave of momentum. Take advantage of the rush of pure power that the market gives traders on a regular basis. If you want to be a consistently profitable trader, you need to learn how to be with the flow of power and money in the market while it is happening. Trade with the stock's trend. That's the way that you're going to make money too. Getting paid by the market is easy if you have the right stock pick, correct directional bias, and if you enter it before the momentum move triggers. Is it possible to do this? The answer is yes. You've got to learn how, knowing what to do, and when to do it. It makes a world of difference. Give your trading an edge by learning how to pick stocks that have momentum and how to profit with these big moves in the market. Is there a way to know the momentum will occur before it actually does? Because that's how you're going to make money. You have to be able to get in it before it goes. After it goes, it's too late. The answer is yes. There is a way. That's why this guy here is thrilled. He's ecstatic. He's happy every day that he trades. When he gets up and finds a gap and picks it and rates it, it rates over 20 points, he loves his life because he is finding things that trade before they actually go to get in them. He's all prepped and ready to go before the market even opens. Here is P. P is a wonderful, nice, beautiful, fat red bar here. This is just a couple of days ago. Do you see this nice big red bar here? This is what I'm talking about when I say momentum. Look at this. Beautiful entry here and all the way down and the whole trade is done by 11.30. Entry time is 9.55. Price is 25.49 to enter. Stop is over 25.75. If you risk 26 cents and if you're an advanced trader and want to risk $520, that's 2,000 shares, exit's 23.80. Full profit is 33.80 in one trade. This is 6.5 times the amount risked to reward, made in profit. This is turning $520 into 33.80 and this is fast. Look where this went. You're entering here. It's a little bit before 10 o'clock and you're out in an hour and a half. This is what I call momentum. This is it. This is what's made this far here. Do you see? That guy right there. That's a nice big fat beautiful move and you can train momentum at any level. Any level you want, advanced or beginner, it doesn't matter. Here, this guy, he just started out, he's brand new, never took a trade in his life. He wants to start out slowly. He has to just take his good old time and he's going to do that and here he goes. He looks for the trade, he gets in the trade and he takes it. The only difference between him and the advanced person is he's risking less money. He's only risking $52 instead of $520 and that's perfectly fine. He's still making 6.5 times the amount made in profit. His shoulder profit is $338 and as you can see, it's a great trade. He risked $52 and made $338. That's fantastic. Learn how the market can pay you with momentum, real, real, real money, not just pennies. Fall earnings season is almost here and it's a great time to trade. It's just a few weeks away and there's tons of volatility momentum that happened in the market in the fall earnings season. Fall is just a great time to trade and it's a great time to be alive. Beautiful, nice fall, crisp air, lots of mums and pumpkins and love the fall decorations. It is a great time to trade and it's a great time to make money and get all ramped up for the holiday season. Making money is fun in the market. If you know what to do, it really, really is fun to trade. Trading is fun. Making money is fun. Learn how. Try the way of the momentum all the way to the bank. The Golden Gap course is a complete system to use to trade the market. It has all the pieces of the puzzle here together and really you need all the pieces of the puzzle. I like to say you only need this thing or that thing, but the answer is no. You need to know everything, a complete and detailed system to tell you what to do, what to pick, how to pick it, how to take it, how to trade it, where the targets are, all of these things. I teach a class. It's called the Golden Gap course. The course is a full two-day course on how to strategically find, pick and play. Stocks at our professional bearish gaps. Retakes are free. The class is online, so if you live anywhere in the world, you can do the course. It is October 12th and 13th from 9 a.m. to 5 p.m. eastern time. Cost is $24.99. And if you're interested and want to sign up, register ahead of time. Space is limited for the class. You can email me at Melissa at thestockswish.com. Get on the right path to success this fall. Don't waste any more time. If you've been trying to make money in the market for a year, stop wasting time on things that do not work. You want to make money. You want to be successful. So, 2014 is really about changing whatever you're doing to move forward in your life. It's almost here. It's time to start making plans for your future to the better. Remember, the future is yours to create, just like my future is mine to create. So, I will see you at the live lecture on Tuesday, Tuesday, October 1st. 5.30 p.m. eastern time.  Thank you so much, everyone, and have a terrific weekend. See you Tuesday.