Thank you for joining us, and our next talk is going to be on horse racing. It's going to be on horse racing, and it is my pleasure to introduce you to Russell Baturini. We're having one hour analysis of this year's Kentucky Bear. Wow. Well, thank you. Thank you, Ming, for that wonderful introduction. I appreciate that. Now everybody knows I'm a gambling degenerate, and I also want to say, sir, this outfit in the front row is fantastic. You have Vegas Def Con. It's all captured there, so very well done. Very well done. So this is Fishing for Economics. So like Ming said, my name is Russell Baturini. I am the senior security architect at a top 20 CPA firm that I'm required to not name. But yeah, that's exactly it.   Very good O-sense, sir. I appreciate that. So it's good. I have actually, I think my voice has had about as much of Las Vegas as it can handle for the week, so hopefully it'll hold out. You may see me chugging water during this talk copiously. But yeah, so the abstracts, I guess, weren't in the book. If you didn't have a chance to look, this talks a lot about user awareness and training and correlating data from different sources to figure out who your highest risk users are and how to remediate that. I think there's a lot more to it than that, in that if you're a penetration tester or even an attacker or a bad guy and want to know who are the users you should be targeting as part of your efforts, then yeah, so I mean, I think there's a lot of value for a different audience and different folks, so we'll get started. So a little bit about me, and I have to clarify, just to make sure nobody knows, last year when I, or everybody knows, I was here and I was sitting at dinner one night and this girl who had had a lot to drink comes up to me and says, are you one of the property brothers? So just for clarification, I'm not one of the property brothers. I don't know where that came from, but it's a good Vegas story to tell, so I thought I'd throw that in, but I am the, like I said, I'm over all the IT security things for a CPA firm, we're the 19th largest in the US, and it's a lot of fun. I have my security and compliance dictator, Chris Christie, who is a lot of help and really good to work with, and we have good complementary skill sets, and we've had some times, but that's what I'm on Twitter. You can find me there, there's occasionally security things there, there's a lot of horse racing things too. There's also horse racing things in this talk, so be warned. Present, I printed it here five years ago, I printed it besides DerbyCon, things like that. And the standard disclaimer is these are my opinions, and this is not my employer sponsoring this talk, and this is all my own research, so anyway. So I always like to start my talks with why do I think the talk is important to give, and these quotes on the board, I kid you not, are things that I've actually heard said inside talks at different security concepts I've been to, and it's always just fishing, it always works, you know, users are stupid, it only takes one, and the thing that's always interesting to me about that is I've been around the community here for a number of years now, gosh, probably going back to 2004, 2006, and I just, we've never been a community that's accepted something as a universal truth or unfixable, right? So why are we perceiving the user awareness problem and the fishing problem this way? Why do we, you know, why do we just say like this is always going to work, it's never going to change, let's just give up? And so hopefully this talk gives you guys some ideas on how you can fix in your own environment. So I'll tell you, I like stories, and this talk will largely be a story.  There really was no training and awareness program in place. There really wasn't a formal information security program in place. Never done any testing, never done any annual training. I'm sure how many people at their job you have the big annual, you have to sit down for three hours and watch videos and yeah, so none of that existed, which given the type of data we handle and the things we also recommend a lot of our clients do, really didn't make a lot of sense. It was one of the first things I wanted to get addressed. And there wasn't a lot of structure. So if say a user got a suspect email, sometimes they would forward it to their boss, sometimes they forward it to my boss, sometimes they send it to the help desk. And so we started to correct all that. We picked a training vendor and started to unify some things. We actually had a mailbox where we would review the messages and send feedback and talk a little bit more about that later. But, you know, it was a lot to fix. But I thought we really headed off the ground nicely. So we did a handful of phishing tests and enough where I thought I had a pretty good statistical baseline for where we were as a firm and we had a 5.6% failure rate. 5.6 isn't too bad, you know. It's a little above where I'd like us to be. I'd like us to be in a 2% to 3% range. But I thought, you know, we're doing pretty good. So we did all the things, right?   That's one of my favorite ones. You know, make sure to change them regularly. Some people at DEF CON could use that advice. But that anyway, three to one rule, folks. That's all I'm saying. Quick PSA here. But, you know, 5.6%, that wasn't too bad. And so we did all the stuff and I was telling, we're ready to do another one and I was telling one of my colleagues, I said, man, people are really grasping this. We've hit them with everything. They're loving it. Everybody seems really engaged. We're going to get down to like 4% next time. It's going to be awesome. We're going to, you know, we're going to kill it and we're going to be in really good shape. So we give the next test and that happened. We got worse. And that's the kind of thing that I just, it makes me want to scream.  We're never going to do this. And it makes me start to think back to those quotes I showed at the original, or the few slides ago in the presentation. And just like, gosh, you know, well, what happened here? So I started looking through and thinking about holistically, how are we approaching user awareness in our environment? And so I kind of came up with a few things, which is, number one, we didn't really have a clear goal on what we should be doing. So should we be trying to fail people? Should we be trying to inform people? Should we just be trying to collect numbers? You know, how should we be doing this? And then it became more of a, instead of a what, like a quantitative analysis, like the percentage is this and it went to this or whatever. Why is this happening? And I think one of the things I like the best about our, our training vendor is they give us a lot of data and access to a lot of data. The other thing, and I'll talk about this a little more later, I'm a data pack rat. And so I kind of keep data from other jobs when I've done this same sort of thing. Or I also do a lot of side penetration testing work. That's actually my background is as a penetration tester and social engineering type stuff. And so I keep it all. And I started to think, I'd like, what if I take all this data and I put it together into like one unified repository and start to analyze it and start to get it to that why that I mentioned the second bullet point. So by the way, I really don't think this presentation is going to last an hour, meaning generously give me an hour to talk or 50 minutes to talk. And I don't even like to listen to myself for 50 minutes, much less subject somebody else to it. So if you guys have questions or comments, feel free to just throw them out. It's fine. So anyway, redefining the goal of our, of our phishing testing and our user awareness training. And I think we get into the mentality of we should try to be tricky. We should just constantly be trying to raise the bar, make it harder on our end users. But if it's just constantly trying to fail people, that's a very negative approach to it, you know. And I think you really have to have a more positive approach where you have that positive feedback loop for the users where if it's really like you're teaching them instead of just constantly you failed, you failed, you failed. Well, look, you know, I learned from the last one, but you made it harder this time. You know, and then I failed it again. You just, you will never get anywhere with improving those percentages and improving people's knowledge and they just get frustrated and they tune you out, right? I don't know if you guys have experience like that or not, but that's kind of been my experience with it. But yeah, I tell you what, can I address that at the end because I'm going to kind of talk about that. That's a good, that's a good point. Now I would say sort of anecdotally, I'll top my head, the positive approach works better. And I've got some more information on that that I'm going to talk about later. But yeah, great question, great question. So I talked a lot about stats and before I dig too much into this and that's the best picture of a data scientist that Google Image Search has. So, but that is not me. I made lots of Ds in math in college. D is for diploma. And so you will probably see statistical anomalies and things that I didn't analyze right or things where there are other reasons for the way they are that tie back to the math. So please, please don't take it out on me or be too hard on me. But anyway, I'm not a data scientist but I do spend a lot of time at this place. Which, and it's jokingly I say that, but you know it's literally looking at data to try to predict an outcome. I mean that's what it is. And that's kind of where I learned to do my data analysis. I was going to the racetrack and playing and trying to predict. So I had this idea and I'll show you this. If you've never been to the racetrack, they give you a program and you get something like this on every horse in every race. And it has every piece of information from the color of the horse, from where the horse was born, from how fast it ran the last race to a description of the last race. I mean anything, and you can take as little or as much of that data as you want or you can throw money away, betting on them, which is fantastic. But I started to think, can we profile users like this? Can we take when there is some kind of incident that happens or they fail a test or something else happens, right? Can you build a profile to start to predictively model that past performance and say, you know, these are the users who are going to have the worst problems with or are going to be the most likely to create a security incident, fail a test or we might need to train in a little bit different way. So that's all it is, it's really trying to predict an outcome. And so I had kind of started reading these two books at the same time, Picking Winners by Andy Byer. Andy built the, he's one of the best handicappers in America and he built the buyer speed figures which are a way of taking data points and creating a metric for analyzing race data and how a race looked. And then Freakonomics, who's read Freakonomics by the way? Yeah, I read it after everybody else did. I think I've been meaning to read it for years. As one of those things you get, it's on your reading list and you know, just keep putting it off. But, you know, if you haven't read it and I'll let somebody else speak to this better, they probably can speak to it better than I can. It's about taking things that seem like they wouldn't be related and using them to compare and predict outcomes and also analyze why certain things happens, like the hidden why of everything. I really liked the ideas both of these books presented around trying to analyze the data and figure this problem out. So, I came up with two key questions and I wanted to decide what were the important data points to predict, predictively model who's going to fail a fishing test or who's going to fail a real life fishing test and do something bad in the environment. And I should clarify too, with user training, I'm trying to predict everything, you know, fishing tests I didn't schedule that somebody else scheduled for me, right? You guys get those. And so, you know, can I predict who has a higher likelihood of falling victim and are there things that I wouldn't think of that were related to a user's performance on fishing testing and the first repository I started thinking about where I could get that data was human resources data. So, that is where we had a collection of data on an individual and I'm fortunate because I've kept in touch with all the HR folks and from places I've done this work and also we have some very generous HR ladies at my current employer who provided me with, in nothing real sense, they're not like performance reviews or salaries or anything like that, but just data on people's resumes and job levels and years of experience and things and it was really helpful data as I started to dig in and take a look at this. So, one of the things I would also say this is a little different than a typical stats talking that we're not really dealing with something that's static. This is people are unpredictable, right? And no matter how many times you tell them to do something they're liable to do this. And human nature is very, very unpredictable and also one thing I would say is I'm going to present what I found from my data that I had. Your environment is probably very, very different. So the idea behind this talk is not to say everything I found is going to be applicable universally. It's to give you ideas about like, hey, I've got this awareness program, I've got this training program how do I take the data I have and maybe look at it in a different way or a unique way and a way that we hadn't thought about before to make improvements in our own program. So, again, no matter how much we analyze this we come up with somebody who's always going to screw up and I think we all know that in this room. Yeah, so this is kind of where I started. I've got about 10 years of phishing test results and three different large environments. I've got side test work or consulting work I've done. I've got data on security incidents which were the aforementioned unscheduled phishing tests where people failed and kept those, took some HR data. I took a survey actually of some of the folks who had failed our tests, of all the folks who failed our tests internally and I'll get into that a little bit more just simple little two-question survey and some other miscellaneous data. I took it all and I threw in an elastic search which we'll talk about and I came up with a sample size of about 3,200 events that I started trying to make assertions from and what I would say is also not everywhere did I have HR data, not everywhere did I have certain pieces of data but I was able to query in subsets where I had different types of data which elastic search is great for if you've ever used it and I came up with about 60 working theories on what I thought would be an important correlation and not all of them panned out to be anything or panned out to be statistically significant but I started about 60 and worked down to the ones that I found had the most statistical significance. So like I said I used elastic search and number one on the list is it's free. Anybody here who ever used elastic search? Okay, yeah. We like it, we don't like it. It's great. I love elastic search, it's so cool. And for the price it's right and like I said using something that was schemalist where I could have events where not every document had the same data points in it was very very helpful in analyzing the data since I had variances in the data and also I was able to use Python real easily to dump data into it which worked really well. So yeah, let's dive into the data now and I'll kind of start showing you some of the things that I found. So the first thing I did was I started looking at figures by years of experience and my working hypothesis when I went into this was the people who have been around a long time when I say that, that's a polite word for old would fail more frequently and I saw that there was actually some truth to that and you see about in the top left of the graph there the green slice about 26% of the figures I analyzed came from people with more than 10 years of experience. So no surprise there. What really did surprise me though was the biggest slice came from the people with 0 to 2 years of experience. So I was thinking these will be the younger people, they're tech savvy they've been around for security or they've been around for security events and technology for a long time, they're going to be up on this stuff they're not going to fail at a very high rate. Boy was I wrong. And so I thought this was pretty interesting and you can see also you look at the sweet spot about 4 to 6 years of experience these are folks they've been around long enough and they're professional enough to be security conscious but you know they don't fail at a very high rate so those seem to be your lower risk users but yeah you have the people who are kind of opposite ends of the spectrum in their career tend to fail more than anybody else and so I was subdivided that 10 plus group further and 40% of that group came from 22 plus years of experience again the old people and I hope nobody here has that much experience and I'm sitting calling you old right now but when I started looking in the other slice with the folks who had less experience I was able to correlate that back to the timing of the test where it went way up I showed you at the beginning so I gave that test in January when everybody had just graduated from college in December so we had a lot of people with no experience who started then and I was like hmm ok and then I started looking at who failed and it was a lot of the new hires so the timing of your test when you have mass numbers of new employees onboarding has changed the risk profile of your company to phishing attacks drastically and I'll show you something else interesting about that here in a minute so I talked to our office managers we have a pretty distributed environment and said hey would you work with the folks who have been around a while will you help them take the training will you make sure they understood the high points of the training and the ladies were fantastic and they were very good about working with them and got some really good feedback on that outreach I think and this is a tangent but some of the older folks who have been around with the rapidity of technology changing they get intimidated by it and have somebody sit down with them and say look here's what's important we've given you this training and we really want you to know this I think it actually meant a lot to them so I got some very good feedback on that and then the other thing I did is I actually changed our new hire training as well to add some new content you need to come in I also changed the way that we gave it I used to give it to them to say knock it out in the first 30 days well now they get it immediately when they're on board it and they get a reminder every day to do it so it makes sure they get it done since they are a higher risk group apparently from the data so I mentioned the survey I gave I gave this just real quick little two question survey and I got a couple funny stories on this and I just asked them then do people who failed these tests this survey was over people who failed and do they feel our internal communications like HR, IT so forth are easy to identify as legitimate communications so as in I can tell the difference between a phony one and a real one and one of the things I found was almost nobody had had security awareness training in our environment or phishing testing to us starting to do it so it was a new concept for them and clearly not enough companies were doing this so my action I took out of that was since this is new we want to continue to aggregate data we want to continue to drive participation in our programs and get them used to it and also because they haven't had a lot of previous training we may need to increase the frequency of our trainings and that one round may not be enough for a lot of folks so that was pretty interesting so kind of correlating to the question on the survey and this is why I wrote that question on can you tell if our internal communications are legitimate or not I looked at the categories of failures and this spread across all 3200 samples I had and you see the top two failure categories are HR and IT and the HR actually made a lot of sense because it ties back to the new hires we talked about how they were failing a lot well if you start a job and you get an email from payroll or benefits or whatever yeah I need to go ahead and do that and you're highly likely to click on it so if you are a pen tester and you want to do your OSINT and get on LinkedIn and see who just started a new job somewhere that might be a good vector yeah total failures this was the category they failed on yeah so 90.8% of the total number of failures came from emails in the HR templates in the HR category about 1 in 5 correct no no no not departments I apologize yes thank you that's a good clarification this is not who failed yes correct no thank you for asking that's a really good point exactly the Office 365 ones those are fantastic that's a really really good question can I come back to that actually because I'm going to talk about that a little bit more but sure right you're talking about statistical skew there and that's a good question and so again I was looking at a body of work that was across multiple environments and multiple engagements I guess you'd say so this isn't just one environment where we did this every three months and we sent X number yeah that's a good question I'd have to go back I honestly don't have those numbers because I draw from a random pool and so there wasn't necessarily an even balance what I would tell you is there's an essentially the same number of templates for each category so the odds of one being drawn over another is about the same okay so does that help? okay yeah good question thank you anything else oh god that one this chart was actually built from all 3200 because I had the data on all 3200 failures yes so yeah okay yeah and that's fair because you could have different populations of colleagues inside those companies who were you know some of them were younger and had less experience and had more and I would say at our company we skew toward the older a little bit but some of those environments so one in particular was a fairly large environment about 3000 employees that skewed more toward younger people so if I had to come up with a distribution again you guys are challenging me on my data science skills here and my statistics skills I made a C in that class so it was one up for math C is for college but yeah I mean I honestly didn't look at that data that's a really good way to dive into the data more and say hey where is the skew and start trying to adjust the numbers for that yeah I think it's a fair conclusion and I would say that probably because the sample size was so large I mean I don't want to say 100% just because I don't have the data in front of me I would say the skew would be insignificant I would say it's going to be about the same out of every sort of category of age so good discussion was there anything else okay one more oh okay we got two more here that's fine yeah mm-hmm yeah yeah actual security incidents yes because I categorize uh no that would be a good thing to do yeah I just I wanted to look just at the at a macro level at the entire body of data data when I was doing this just to get an idea of what it looked like but that would be good for further research absolutely some great ideas yeah yes ma'am hahaha we did they did not like it they said it looked unprofessional when we replied to emails so what that again and so that was that was on me I'm okay so we'll get off on a little tangent here that was on me that was one of the first things I did when I came in was say we need to do this and we hadn't really built that trust in the security program yet to where they understood like if Russell saying something we probably need to do it you know it was more just me coming in with the jack hammer and like we need to do this this this this and and so one of the things I've learned it's a cultural thing is you have to slow down with them and you have to bite things off in small chunks and you have to when you start trying to grab and grab and grab and like oh we need to do everything all at once they don't respond well so that was backed out now we are revisiting that and then maybe something we wind up doing but yeah they we derived that they didn't like it so um anything else I think yeah one more than I really need to move on we can we use those yes we use the fishing button for reporting email it's we started with just a generic forwarding mailbox and then we use the button and they they love the button and one of the things is great the button we get from our training vendor and you may know who it is I think they all do is when it's a test and they hit the button they get the little hey congratulations you passed the test and yeah that works really well so no thank you so much for the discussion that's those very good discussion um so uh moving on so this is where I found a huge huge disconnect I mentioned that the survey data showed that uh or I gave the survey and I asked them I said do you think that you can tell a legitimate email from our IT department or HR department from a fishing one and they were all like cool yeah we totally can but then you go back to this and you say so so there is some huge disconnect here that we have yet to figure out now getting back to one of the questions and I apologize I forgot who asked it um oh it was about the trust in HR we don't at our firm have a good standard look and feel for uh internal corporate communications they just kind of come from a person and I guess we're kind of that that small business mentality that we still have uh because we were small and then we got really big really fast of everybody knows this is the HR lady so when someone sends you something then it's legit but um yeah so there was no good consistent way that the communication is supposed to look and feel um and so I actually talked to our marketing manager about that and she is working on a more standard template for communication so if they look a certain way they know it's real and if they don't it's fake it's kind of a way of mitigating the missing external tag of at least giving the email the body should look a way and then if it doesn't you kind of know it's fake um uh and and I've heard that she's had some challenges getting that done they don't feel like it's really necessary but uh that's another one we're gonna I'll fight to the grave on so um the next thing I looked at was time the next thing I found uh statistical significance in was timing of things uh and I love this picture uh but you know how did timing related to certain events uh affect people's performance uh on on uh phishing tests or when it came to identifying uh phishing messages in the wild um and so this actually surprised me so I started gauging uh the number of people who failed based on the time it took them to complete security training it could have been their annual training it could have been a refresher training after failing failing a phishing exercise um it could have been um just something else we gave as an ad hoc uh and generally training I always give 90 days to complete uh and I thought that people who did it really really fast would do really really good on phishing tests what I found out was they're doing it really really fast just because they want to get it done and they don't care about what's based on this data so you see actually people who completed the training within the first 30 days of a 90 day campaign accounted for what is that 43% of the uh of the failures so yeah okay it is it breaks down pretty easily evenly so if I do a 90 day campaign it generally is about a third a third a third um so uh I do find that uh I do start pushing on them of course that may be the byproduct fact that I push on them every 30 days to get it done they get a reminder so uh I give an informal one yes I give an informal training yeah an informal evaluation yeah so I send out spot checks to some folks so um anyway yeah I this surprised me so you see the block is the the gray block is people who took a really long time to complete the training they waited until the last minute before they got their network account turned off or whatever uh to get it done um that was expected this block uh the blue block I didn't expect so people who kind of fell into the they were waiting for the right time to do it and digest it uh did fairly well they looked down there at the at the orange slice 30 to 60 days in um I think they did fairly well so again my conclusions I reached completing training early not necessarily an effective uh uh an indicator of how effective the training was because people did still fail at a fairly high rate um and people who wait for the right time to do it are are less risky than the other group um you know one of the things that I did change after this was the communication of the uh the um training reminders uh I actually did swap them to remind them in 30 days or whatever uh generally about a a third of the way uh each time before the training deadline um and the other thing I did was I talked to our office managers and I said send me the busy times so we do tax uh and there's not just April 15 there's various IRS deadlines throughout the year and what I wanted to do was make sure people completed training outside the busy times because I knew if it hit busy time they just wouldn't do it so um so anyway uh computer based training and uh yeah yeah it's it's all right so so when I say training that's a broad it's a broad category so we do an annual training um and we do refresher trainings um and then in other events I got some of the data uh from and also in our current environment we do um just kind of ad hoc you know a new firm merger or company comes on we'll do a training then uh we'll do specific targeted training as requested for various business units that kind of thing and so oh that's gauged on this so um do we follow up with testing? I'm going to do the testing quarterly that's how I've watched them the testing is just quarterly and it from the time that they completed the training yeah yeah yeah I mean it can create a little skew I agree with you yeah but um the training occurs quarterly okay let me say that generally there is some kind of training for a population of users quarterly and then there's there's phishing uh quarterly so um as well so um this gets back to what you're just asking about too so I also looked at the days since a user took a training before they failed the test and um as you can see about 60 days 60 to 90 days out from the last time they took the training is where the largest body of failures occurred so um I thought this was pretty interesting I thought this actually told us pretty much the lifetime of our training is 60 days and when I talk about training one of the things I would mention is you only have to tell them to hover the mouse over the link so many times you know you would think but I think any you can give that's a little hint or just something about security awareness is it gets at top of their mind and um and I think that's very very important um so yeah yeah that's about right the phishing test occurred quarterly um I what I said was some kind of training occurs quarterly our big training we do outside tax time the one that everybody has to take that's long uh we do during non-busy season which runs about June 1st to September 1st that was actually one of the things I improved from last year when we did this last year I did it and it overlapped IRS deadlines and I got um I got a little heat for that which my thought was you should have done it in the first when I sent it out because it wasn't busy time you know but then they waited the last minute and then it became busy time and you know so that's how that worked um so anyway um conclusions that kind of reached from that that sample was that the training lasted about 60 days um if we don't reinforce it frequently and refresh people and again it could just be refreshing people on any security topic um will they'll fail more so uh we do a lot of reinforcement now we actually started sending weekly messages out just little tips and things like that uh I talked about doing multiple small trainings getting away from like one large you gotta sit out and do it for a couple hours uh every year uh and I was told for us that's actually an issue because we use um our training as internal uh continuing education credits for uh some of our tax and accounting folks and so um it has to be a minimum length so I would rather do like four very small 20 minute trainings uh than one large training but um I'm told that we can't do that so um but something about for your environment if you don't have that challenge um so other weird stuff and I hope you're not weird out by clowns I thought a meme of Ronald McDonald talking on the phone about environmental factors completely captured uh weird stuff uh but I looked at a couple other weird things just kind of threw these in here for fun uh here at the end of the presentation um uh failures by time of day uh you can see that early in the morning lunchtime going home time uh tends to generate the most failures uh one of the things I think happens here as well is when the fishing campaign starts the general starts at 8am and I didn't think about this and I've always done this with every one of them I've ever run starts about 8am and a bunch of people fail and then they talk IT's testing us again because they figure out that and so it drops way down and then you know there's a shift change or people go to lunch they're not paying attention or they didn't get the water cooler gossip that I was coming after them and then they fail a lot and then it goes back down and then at the end of the day it goes back up but um I think it's actually a good habit to get your users into because they communicate yeah I did not find a statistically significant correlation uh based on day a week the only uh it was all pretty even uh time had the biggest uh biggest impact so that's that's a good question yeah I did look at that though appreciate that um and so you know it was uh you know I think oh yeah users I think getting them the habit of talking because you know one guy will say hey I got this email from you know the CFO and oh yeah I got that email too he's asking me the iTunes gift cards and then they start to figure out something's not right uh which is really good but um but anyway um I also looked at the weather just because I thought it would be fun and so I want to figure out if it was raining or not raining uh and I did figure out that people did a little bit worse not statistically significantly worse but a little bit worse when it rained versus when it was uh was sunny outside so something to think about well just thought it would be interesting to figure to look at you know as well as real freaking omics things I thought I could be in the next book I guess uh so uh so anyway um a few more thoughts though that I had that I want to share about stuff that that we did and we've talked about a little bit of this and I really do appreciate all the questions and and discussion um I've found uh and and Christy and I have found that the more we talk to people on a personal level uh it really really um makes an impact and if you make them feel like they're contributing and they're making a difference in insecurity that they they do better uh you know I told you we have the phishing buttons we have the spam box we reply to every one of those messages personally and tell them when they don't get like an automated form thing back like we reply to them all hey thanks sometimes I'll even cut up and joke with them like oh man look at this guy he sucks or you know something like that just well what an idiot he misspelled your name in this email it's something stupid to make them think it through and think that you're really paying attention they are contributing so um I found that's really effective um shaming never works never that you failed you failed walls of shame for people who clicked on the most messages or whatever that that just doesn't uh doesn't work I've also tried to run contests in the past and that um that creates some real animosity because apparently a twenty five dollar itunes gift card is very coveted uh so you know where yeah we should now now we use the button and it has a the positive feedback loop where they get the message that says hey congratulations and you've passed the test it's great um yeah oh like if they yeah I mean we do in terms of like I just mentioned when they report things we reply to them and say hey you did a great job catching this that's awesome I would love to have the budget to hand out like a tangible reward like a starbucks gift card or something but our volume is way too high the users what's that yeah that's a good idea that's a really good idea yeah yes we use security incidents inside the sample as well yes um yeah yeah quarterly is what I prefer because they get worn out on and so that's a that's a good story um so on the on the survey I actually did leave a third open ended question where I said write me comments about the you know in fishing test or whatever anything you want and and you know it'll be anonymous you don't have to tell me who you are and that became a field where people explain to me why they failed the fishing test or why they hate the fishing test uh and so I had one who was just like these are a distraction from our customer business and you know I had um I had you know I was buying my son a cell phone and got an email from about a cell phone you know um but they the users do not like to feel tested um and that was one of the things that our training vendor was very helpful in recommending me was like give them the training first make sure they're comfortable make sure they're trained and then start testing them because if they don't feel like they've been adequately prepared and then you give them a test they'll hate it and they will never want to participate in it again um so yeah yeah in the back give your hand up for a little bit there yes yes we yeah we did and we have a few who have been um repeat offenders and I tell you what um this gets back to the shaming thing so this is a great time for that question in previous lives if we had repeat offenders I wouldn't talk to their manager and said you need to get these guys in line and um that was not very effective because they got mad they felt like they were under the gun they were being uh uh strung up a little bit hung out to dry were tattled on and um in our environment here where I work now I just reached out to them personally getting back to that contact thing and said hey look we've had the training you failed a couple what can I help you with and that approach I found works way better than going and trying to create some sort of shaming environment um so yeah um I mean they uh you know I got a number of different responses uh some some of them gave me the excuse this is why I failed and some of them were just like really there were complaints about the IT department you know I don't understand what's legitimate and what's not and which we saw from the from some of the data um uh but mostly they were just embarrassed and they said I'm so sorry I failed a couple of these you know how can I do better and they reached out and said and I gave them the sort of the flyer of the mouse over the link look and and and the folks I tell you the folks we reached out to personally they've never failed another one so um go gosh I do it could you guys hold your questions for the end I'm gonna run through these last couple slides and then we'll field some more so I just got two slides left here uh so um of the of the results I don't feel like I've got enough data we haven't implemented everything yet again I've had some challenges with some getting some things implemented but um we did drop 2% uh after the bad test where it went up to the next test so I felt like that was really good now I want to do a couple more tests to make sure that wasn't some sort of just anomalous thing I want to see particularly with the timing we talked about the next batch of new grads who come in I want to make sure they do better and and just make sure that that it's a continued trend downward before I say conclusively this is the panacea for everything in our environment but I will tell you the feedback I've gotten and really more than stats when people email me and say I really like the trading I really like the stuff you guys are doing it makes me feel better than seeing a percentage drop down or something like that so um I've gotten a lot of that uh and and that's um that's that's been very very helpful uh so anyway yeah that's that's it that's the material I've got uh thanks again me for introducing me and uh packet hacking village guys for let me come talk that's me I'll throw these slides up later there uh if you want them and uh yeah let's grab some of the questions uh and have some more discussion here so alright no no let me answer your questions come on alright yeah no I that would be a that would be a good next place to go so the question was did I separate the actual phishing emails from the uh the tests and yeah I I wanted to look at the whole body of data because I like to think my tests are so good they're like real phishing emails I guess so anyway um yeah no no I'll go ahead yeah I'll get him next yeah so 15 minute refresher training yes my licensing for my training platform doesn't let me get to the games because I'm on a budget so uh but that's something I would like to do is actually analyze that and printed material versus an interactive exercise I like our training vendor uh I'm not here to sponsor anybody so I'm not gonna say who it is but they the training they provide is highly interactive so I'd like to think that's uh that some of it um as well let me see okay yes ma'am and then I'll grab you back here okay right I well I and I think that gets back to that whole data where you're talking about technological aptitude where the younger folks who I would expect to be more technologically apt than our older folks still failed regularly so that that lines up exactly with what you uh you just asked so yeah that's a great point um yeah that's a good question yeah so um I will tell you that uh was are you asking for two parts like did I compare failures to successes or just strictly around holidays okay uh no I look strictly at failures in this this exercise and that that's a great question and that would be another another um really the successes I only have success data on my current environment I don't have it on previous environment so that that would be a little bit more difficult holidays that would be a good timing based thing to look at as well so um that's a good question I just kind of looked at day of week and time and things like that so um yeah oh never uh no some people like to take their junk folder and just fish fish fish fish yeah so they do that yeah so yeah we get a lot of them yeah mm-hmm yeah they could there should be a distro that's actually a good point but most of them just email me directly so we have a fairly small security team it's the two of us so between one or the other it's they find one of us so yeah oh gosh yeah go ahead uh uh pit you guys fight it out amongst yourselves who wants to talk first mm-hmm we do that too yeah the good thing about the vendor we use uh is it's a it includes the original url as a query string parameter so I actually teach people like hey look it's not right here where you'd expect and where the training says it is it's over here so yes correct yeah so it's still in there yeah yeah go ahead sure mm-hmm that's a good question that's that's yeah I mean we're our environment is about 2200 uh so we get 100 ish a day maybe I mean it just depends yeah now one thing we do I will say this so if we get a broad like 400 people get the same email and they all report it we have a little word press site I nailed up and we'll just post it there and people are actually referred to that said like hey before you send something in check the fish board see if it's on the site first um so you know really what we're applying to is a lot of the one-offs um it's um we really need about five interns to do that so we can do better stuff but uh but yeah while they're trying to offer yeah well and we try to train them in multiple parts that's like that's like one of the last things we tell them to look at it's really like who's the sender were you expecting it does it have an attachment you know all those things and then the hovering sort of a last resort now we're also fortunate to we use the vendor that does the link rewriting so they've blown up the link and scanned it and it lands them on a splash page as this may be malicious I've also found the splash pages and stop our users from clicking on things so I mean you know we've layered up God knows how many URL filtering and that and they still somehow go around all of it but uh yeah anyway so anything else oh okay yeah okay mm-hmm yes it can ooh as valid no that's a great point that's actually something to think about okay anything else awesome yeah what do you mean in terms of multiple like email domains and or just yes so ours right now we're spread way out like I mean we're I work from home and I'm not near any of our so uh yeah we have about 80 offices and they're spread from across lower third US yeah actually that that's a really great point and so we did have and this is not my current company this is a previous employer had a similar decentralized environment um we did have an office that was out in Seattle who we never visited just because they were out in Seattle and I'm from Nashville and so we found that they did not do real well on the phishing tests repeatedly they didn't have a local IT they didn't we didn't do any security testing they were kind of man on an island out there and um yeah that that is the amount of interaction you do with them uh it does make an impact yeah so I think it's really important to try to make everybody feel part of the program and feel that personal touch so yes yeah we actually took a trip out there and we sat down and had a like a security brown bag two hours just me and um our director of compliance and let him ask whatever questions they wanted and things like that so yeah so this is all domestic data only domestic data yeah so okay yeah we do track statistics on the device that was used and uh I have found that mobile devices people will open crap on their iPhones every time they get it so um yeah well thank you guys I know this is a tough time slot oh I'm sorry there are a couple more questions for using templates uh no well so now I stick strictly to what our training uh vendor provides but um yeah in the past you can clone I've cloned a few so yeah good well thank you again for coming appreciate it guys yeah


We are doing the random here for the triple card that was just pulled out of the last flawless, the 2021 community flawless hobby, two box full case break number 29 pick your team. Gonna do the random here between the Giants, Chargers and Redskins. Someone has to laugh at them, so I feel like I'm kind of funny Camel, but it's all good. All right, we've got two and one that is three times on the random, three times. Let me just get them typed in real quick. Giants, Chargers, and I'm putting Redskins because that's what's on the card. All right, here we go, three times. Good luck, again, top team after the random will get the triple wallet card. Good luck. One, two, and three. It's gonna go Giants, Jeremy Shockey. Giants is going to get this triple. Sorry about that, y'all. Thanks again, and we'll get these cards right out to ya.


Good evening aspirants, welcome to the hindi news analysis by Shankar Eise academy for the date 26th August 2019. These are the list of articles chosen for today's analysis. It has been given along with the page numbers of Chennai, Bengaluru, Delhi and Tiruvannapuram editions of hindi newspaper. The link for the handwritten notes and the time stamping for the displayed articles is given in the description box below and for the benefit of smartphone users the time stamping is also provided in the comment section. Let's move on for the first article analysis for the day. This discussion is based on the finding of the National Commission for the Protection of Child Rights with respect to Micah Mining in the states of Jharkhand and Bihar. The syllabus relevant for the analysis of this news article has been given here for your reference. We have a National Commission for the Protection of Child Rights. This commission was set up in the year 2007. It is a statutory body that was established by the Commission for the Protection of Child Rights Act of 2005. Based on this act there are specific functions for this commission. So now we will see some of the important functions. This commission examines and reviews the various safeguards that are provided for the protection of child rights under any law. It also has to examine all factors that inhibit the enjoyment of rights of children. Here the children could be those affected by exploitation say for example, exploitation by child labour and also other vulnerabilities such as communal rights, maltreatment, natural disaster and so on. So the commission has to undertake and promote research related to child rights and on its own it can inquire into the complaints related to the violations of child rights or it can inquire by the submission of complaints by other persons also. So now these are the functions based on which the NCPCR has conducted a study to understand the issue of child labour in Micah Mining in the states of Bihar and Jharkhand. Earlier an international child relief agency that works for the rights of children has reported that more than 20,000 children were employed as child labourers in the Micah Mining areas of Bihar and Jharkhand. This international agency is Thardesam. This agency has its headquarters in Switzerland. So the report by this international agency disclosed to that even now child labour to this extent can be seen in mining industries in these states. So to understand the reality and to know the gravity of this issue NCPCR has conducted a study where it has found that more than 5000 children in the age group of 6 to 14 years are exploited as child labour and this is found especially in the Micah Mining districts of Jharkhand and Bihar. So related to Micah Mining and the involvement of children the noted districts are Koderma and Giridhi districts in Jharkhand and Navada district in Bihar. This means more than 5000 children are involved in these three districts itself. So the overall number in all over the state could be much larger than this number. The children are used for selling of Micah scrap and other mining related activities and these are the main means of livelihood for many families in the concerned districts. That means if children in this poverty struck families did not work in Micah mines and related activities they will not be able to lead a basic life as they cannot buy the essential requirements like food, water and other essentials. In other words poverty is the main reason that drives the parents to make their children to work. As a result of this the children have abandoned education and the families were unable to realize and see the benefit of education for their children through the schools. Therefore the NCPCR has recommended that the mining industry and its supply chain should be made free of child labour and strict actions has to be taken against the buyers of crabs from children. By the suggestion of taking strict action against the buyers the idea is that they are trying to demotivate the children and their parents that nobody is going to buy the Micah scrap from them. So the parents will think involving the children is almost not useful but this idea has some negatives also because without addressing poverty this issue may not stop in long run and also it may lead to a situation where parents may sell the scraps that are collected by the children instead of directly involving the children in selling. So there has to be more credible mechanism that supports these families financially and at some time it should also encourage the parents to send their children to school. So now let us see few safeguards available for children against child labour. Our constitution provides the first safeguard. Article 24 of Indian constitution prohibits children below the age of 14 years to work in any factory or mine or in any other hazardous employment. So the child labour prohibition regulation act of 1986 bans employing children who have not completed 14 years of age. We should also know that after the child labour prohibition and regulation amendment act of 2016 the principal act also prohibits employment of children in the age group of 14 to 18 years in certain works. These works are mentioned in the schedule of the principal act. The schedule also mentions the term mines. This means even the children up to 18 years shall not work in mines. Here when we say principal act we mean the child labour prohibition and regulation act of 1986. So now let us see few facts about the mica mineral in India. India is one of the largest producer of mica. The news article mentions that Bihar and Jharkhand are the main producing states. And this is with respect to the production capacity. So what is the share of total resources of mica in this state? In terms of availability of these resources Andhra Pradesh has around 41 percentage of mica resources and just around 3% of the mica resources are found in Bihar and Jharkhand together. But they are found to exploit the ores and produce mica. That is why they are the main states in terms of production capacity though the availability of resources is comparatively lower than Andhra Pradesh. The news article also mentions that mica is used in buildings. That is they are used in building and construction materials. They are also used in electronics that is they are used in electronic components such as pyro meters, radar systems, medical electronics etc. And then they are also used as a part in capacitors, electrical insulators, thermal conductors and also in electrical heating wire. And then it is also used in paints and cosmetics also because mica is known to add glittering effect in them. With this we have come to the end of this article discussion. The practice question displayed here will be discussed in the last session. Moving on to the next article discussion which is based on this open editorial that is about the repeated Kerala deluge or severe flood. The article is authored by Madhav Ghatkil who was the chairman of the western guards ecology expert panel. This panel is also called as the Ghatkil commission which submitted its report to the union environment ministry in 2011. In 2018 Kerala witnessed devastating floods and landslides which resulted in huge financial losses and human tragedies. According to the author the people believed that it was once in a century tragedy and so normalcy would return soon. But again this repeated in 2019 with a series of intense floods, landslides, financial losses and human tragedies. This made people to realize that it is unwise to continue the business as usual and it was time for them to think about new options before them. So what are the alternatives that are available? The alternatives are available in the recommendations of western guards ecology expert panel. Here the author notes that the recommendations would not have preempted or prevented the intense rainfall but it would have definitely reduced the scale of devastation that was caused by the downpour. The author says that all the recommendations of the commission were based on careful examination of facts. Also the policies which were prescribed were within the framework of our constitutional duties and laws. The report did not ask for any new legislation but it just suggested to follow the existing laws that are related to environmental protection. It also suggested to follow the devolution of powers. The devolution of powers is from the state government to the Gram Sabha and to the ward level. The author says that the commission suggested this because Kerala leads the country in democratic devolution of power that is Kerala has a strong local self-government. To substantiate this point the author cites one example. It is the Plachimada agitation against the Coca-Cola company in Palakkad district of Kerala. In the early 2000s the Plachimada Panchayat had cancelled the license of Coca-Cola because the company polluted and depleted groundwater reserves. It also led to drying up of wells and eventually it impacted agriculture and livelihoods. But the company counter argued that the state government granted the license to the company and Panchayat was subordinate to the state government so it cannot cancel the license. But the Kerala High Court ruled in favor of Plachimada Panchayat saying that the grassroots institutions have authority to decide on the course of development in their own locality. After this the Kerala legislature unanimously passed a law asking the company to pay due compensation to the Panchayat for the losses. The author says that Kerala has also been at the forefront of the country's literary mission of the late 1980s. The state pioneered in Panchayat level resource mapping of land, soil, water bodies etc. This was followed by the People's Planning Campaign that attempted to involve every Panchayat in the preparation of a Panchayat Development Report. So these are the reasons the author gives to say that Kerala has a strong local self-government. Then the author notes that the Western Guards Ecology Expert Panel called for a model of conservation and development that are compatible with each other. It sought to replace the prevailing develop recklessly, conserve thoughtlessly pattern. It wanted to replace this with develop sustainably, conserve thoughtfully pattern. So this fine tuning of development practices would require the full involvement of local communities. This would also ensure that no development or conservation priorities would be imposed on the people. But the recommendations by this report were considered as impractical and it was not implemented. The implementation of the recommendations would have helped to achieve the bottom-up democratic process of safeguarding ecological sensitivity, safeguarding the biodiversity and the safeguarding of water tower of Peninsular India which is the Western Guards. Then one of the most important recommendation was to demarcate areas within the Western Guards as ecologically sensitive zones under the Environment Protection Act of 1986. The author says that in line with the National Forest Policy, the commission decided to assign 60 percent of the total area of Western Guards in Kerala as a zone of highest ecological sensitivity or ESZ1. This would also include wildlife sanctuaries and national parks. The commission also proposed two indicators of sensitivity. One was elevation and the other was slope. In Kerala, rainfall increases rapidly with elevation. So high rainfall and steep slopes causes localities to be vulnerable to landslides. So areas prone to landslides would come under ESZ1. Then a third indicator was also given for this. It was the extent and quality of natural vegetation. You know that landslides are controlled in areas where there is intact natural vegetation. This is because the roots bind the soil. So any disturbance to such vegetation would cause landslides in any locality that has steep slopes and when a locality experiences high rainfall. Here by disturbance, the author means quarrying or mining, replacement of natural vegetation by new plantations or leveling of the land using heavy machinery or even the construction of houses and roads. So the commission recommended that such activities that causes disturbances to be avoided under ESZ1 areas. The author says that if the recommendations had been implemented, the extent of intensity of landslides and the losses in Kerala would have been much lower. So the author says that it is time to look into the recommendations again. For that we need participation of people especially at the grass root levels because democracy is the active involvement of citizens in governing the country at all levels, most importantly at the local level. So the Kerala High Court's judgment which upheld that local bodies have the authority to decide on the course of development in their own locality must be made operational across the country. So the author says conservation of nature should not be merely regulatory. But it should include positive incentives such as service charges also. The author also suggests that we must hand over economic activities like quarrying to agencies like Kudumbashree groups that are accountable to local communities. Here Kudumbashree is a women's self-help group in Kerala. The author concludes by saying that the sovereign people are the real rulers of India. So we must engage ourselves more actively in the governance of the country. This can be done at the local levels and we have to lead it to a path of people friendly that is development oriented and nature friendly that is conservation oriented development. With this we have come to the end of this article discussion. This practice question will be discussed in the last session. Moving on to the next article discussion which is about the blue veil, the syllabus with which the discussion can be linked has been given here for your reference. The article states that a research scientist at the Koringa Marine Museum has assembled these skeletal remains of dead blue veils. By this the research scientist has configured or put together a life-size skeleton of the blue veil. Now, also know that the Koringa Marine Museum is in the state of Andhra Pradesh and the skeletal remains were collected from the Machili Patnam coast. So now, let us see what is special in these blue veils that we are discussing it today. Blue veils are the largest animal in the world. Even it is the largest animal ever to have lived on our planet. Blue veils can grow to be about 100 feet or 30.5 meters in length and they weigh around 160 tons to 200 tons which is equal to approximately 33 elephants.  Even the newborn blue veils are about 23 feet or 7 meters long and they roughly weigh about 30 tons. So even the newborns are bigger in size. These blue veils are mottled bluish-grain color as you can see in this picture. These giant blue veils are found in all oceans. So the blue veil is a cosmopolitan species which means it is found all over the world. According to IUCN they are absent or not found in some regional seas such as the Mediterranean Sea, Accord Sea and Bering Sea. Some of the interesting facts about these blue veils are that as they are the largest animal to have ever lived on earth which is of 100 feet length it is said that they are even larger than dinosaurs. One another interesting fact is that a blue veil heart is the size of a small car. It is said that the blue veil aorta which is the main blood vessel is so large that a human can crawl through it. Then the blue veil blows which is called as pout consists of air and water and the spout rise about 30 feet or 9.1 meters high. See the veils breathe air just like humans. However as they live in water breathing is a little more difficult for the blue veils than it is for us. Most veils can hold their breath for prolonged periods of time.  This action of excelling air is called as spouting which is also called as blowing. This spouts help people to identify veils. This is because blue veils have the highest to spout which can rise up to 30 feet or 9.1 meters. Then one another interesting thing is that these blue veils are louder than jet engine. A blue veil calls reach 188 decibels while a jet reaches 140 decibels only. It is also said that their low frequency whistle can be heard for hundreds of miles and the whistle is probably used to attract other blue veils. We know that veils are the top of the food chain. So they have an important role in the overall health of the marine environment. Like other large veils, even the blue veils are also threatened by environmental change including habitat laws and toxics. The blue veils are harmed by ship strikes. Many are injured or even they die each year from impacts with large ships. They are also harmed by becoming entangled in fishing gears. Blue veils have few predators but they are known to fall victim to attacks by sharks and killer veils. And one other reason for the decline in the blue veil population was that the blue veil was subjected to major commercial hunting in the past. The intensive hunting of blue veils which started in the late 19th century brought this species to the verge of extinction by the 1960s. After that it was given international protection. This is because hunting of the blue veil is now prohibited by the International Veiling Commission since 1966. But today the most significant threat to the species may be the declining availability of krill. Krill is also a marine animal and it is the primary food source for the blue veils. Then also know that the species is listed on Appendix 1 of the conservation on international trade in wild species of fauna and flora that is sites. Then it is listed on Appendix 1 of the Convention on the Conservation of Migrated species of wild animals also that is in CMS. Then it is also listed as endangered on the IUCN Red List of Threatened Species. Then if we consider India, the blue veil is protected by the Wildlife Protection Act of 1972 under Schedule 1 of the Act. And the IUCN has noted that after the effective implementation of conservation measures there are signs that the blue veil population is slowly recovering. With this we have come to the end of this article discussion. Moving on to the next article discussion which is about India's compliance to one of the data standards initiatives of the International Monetary Fund. The syllabus relevant for the analysis for this news article has been given here for your reference. This news article mentions about the report that is released by IMF on India. This report talks about how India observed the requirements under the special data dissemination standard or SDDS initiative. This report is titled as annual observance report of the special data dissemination standard for 2018. This SDDS is one of the data standard initiatives of International Monetary Fund. The article mentions that abiding or adhering to the SDDS requirements is a practice that is mandatory for all the IMF members. It has stated that India has failed to comply with multiple requirements under SDDS. This has happened in spite of monthly reminders by IMF. These monthly reminders were sent to India by way of monthly reports. These monthly reports are sent by IMF to inform the SDDS subscriber countries about their observance with these standards. But it is found that other comparable countries or other comparable economies in the bricks framework have maintained the near impeccable record. That is other countries in the bricks grouping have complied with the requirements almost in a near perfect manner. Then the article also compares India's own performance in the present time with respect to the time till 2016. By this comparison, one can say that India's compliance level in 2017 and 2018 is not on par with its own performance in the years till 2016. Generally, we can observe three kinds of deviations with the requirements of SDDS. One is with respect to delays in data dissemination. There are more than 20 data categories under SDDS that helps in reflecting the economic and financial situation of the country. And delays have been observed in some parts of these data categories. The second deviation is with respect to listing the data categories in the advance release calendars. The term advance release calendar is used in statistical systems where it refers to a statement on the schedule of release of data in terms of periodicity and timeliness. It projects the policy of the government regarding the release of statistics according to a pre-announced schedule. And the availability of the statistics according to the announced calendar. For example, if the government clearly mentions when it will be releasing all the data categories and if government follows that calendar, that means government is following the SDDS requirements superbly. But the news article mentions that in around three categories, India has not mentioned a prescribed entry in its advance release calendar. Then the article mentions that India's relative non-compliance with respect to some of the SDDS requirements is a recent phenomenon. And IMF has stated that these deviations are non-serious in nature. Note that if IMF considers the deviations as serious, then some specific procedures would be adopted against the particular member country. These procedures are to make the country to adhere to the SDDS standards. So now let us see the comment of the Deputy Director from the Department of Economic Affairs with respect to the matter. He has stated that the non-compliance issues are a result of few technical glitches. These glitches were because of various changes made in 2018 in the website of Ministry of Finance. For the standards, Finance Ministry website usually hosts the National Summary Data page or the NSDP. Every member country will host this NSDP page under SDDS. This summary page has to be hosted by Ministry of Finance. But in India, some of the data for NSDP were available in websites other than Finance Ministry's website. The publishing of NSDP information in Ministry of Finance website was with delays. Though the data is not available in Ministry of Finance's website, most of the data were found in timely manner in other websites of the government. This is one of the reasons why IMF termed such deviations are of non-serious nature. However, some of the experts, more importantly the former acting Chairman of the National Statistical Commission has criticized that India's deviations were because of inadequate attention paid to data dissemination. Also the present data collection efforts are not matching enough to ensure the quality of data. He also mentioned that India's performance in providing information under the data quality assurance framework is also patchy, irregular and poorly edited. This article may be referring to the data quality assessment framework of IMF. This framework was earlier launched in 2001, but it was revised in 2003. This framework is an organizing model of the IMF's activity regarding the data modules of the report on the observance of standards and codes. And with respect to the employment data, the link given by the government directs to the data collected in 2011 to 2012, which was collected by the 68th round of National Sample Survey. This means that the data on employment has not been updated for the present time. He has also stated that the statistical systems in the present times is not up to the previous high quality standards and the systems also lacks credibility. These are some of the comments with respect to the India's relative non-compliance on SGDS mechanism of IMF. Now let us see some data standard initiatives taken by IMF. In the year 1994, there was a financial crisis in Mexico. After this financial crisis of Mexico, the international financial community recognized the essential role of data transparency for meeting the challenges and the risks of globalization. It also recognized the role of data transparency in reducing the likelihood of financial crisis. There was a need for more timely dissemination of reliable macroeconomic and financial data and there was a need for an improved early warning system so that a quick response can be given to such financial shocks. Therefore, IMF has introduced the special data dissemination standard for its member countries. They aimed at guiding the member countries in providing the economic and financial data to the public. The SGDS identifies four dimensions of data dissemination. They are the data coverage, then periodicity or the frequency and tenderness of the data coverage and data reporting and then access to data by the public and then finally, integrity and quality of the disseminated data. This SGDS was introduced as the first tier of data standard initiatives. The second tier was introduced in 1997. It is called as General Data Dissemination System. It aimed to provide assistance and framework for some countries so that in some time these countries will be able to meet the requirements under SGDS. The General Data Dissemination System or GDDS system has been superseded by EGDDS system in the year 2015. Then as a third measure, the IMF introduced SGDS plus in 2012. This is to further reinforce and supplement data standard initiatives. Its purpose is to assist the member countries for the publication of economic and financial statistical data comprehensively and also in a timely manner. The data given under SGDS plus has to be accessible and reliable, particularly in the face of continuing economic and financial integration in the world. The main aim of introducing SGDS plus is to address the gaps that were identified during the global financial crisis of 2007 to 2009. The SGDS plus is also open for all SGDS subscribers. Right now India is subscriber only to SGDS. And we can see countries such as US, Canada, France, Japan are subscribers to SGDS plus. So with this we have come to the end of this article discussion. This practice question will be discussed in the last session. Moving on to the last discussion for the day which is with respect to the advisory board for banking frauds. The syllabus relevant for the analysis of this news article has been given here for your reference. The news article states that the Central Vigilance Commission has constituted the advisory board for banking frauds or in short ABBF. This board is to examine bank frauds of over Rs. 50 crores and to recommend action against it. It will be headed by former Vigilance Commissioner of Central Vigilance Commission. This ABBF was formed after reconstituting and renaming the advisory board on bank, commercial and financial frauds of Central Vigilance Commission. This ABBF is formed in consultation with the RBI. It would function as the first level of examination of all large fraud cases before references are made to the investigative agencies by the respective public sector banks. This board will have four members including the chairman. Their tenure would be for a period of two years. Its jurisdiction would be confined to those cases that involves the level of officers of general manager and above in the public sector banks when there is an allegation of fraud against them. The board will periodically carry out fraud analysis in the financial system and it will give inputs to the RBI for policy formation related to the fraud. The required logistic and analytical support along with the necessary funding to the board will be provided by the RBI. The banks or lenders will refer all large fraud cases above Rs. 50 crore to the board. Then the concerned bank would take further actions on the matter based on the recommendations of the board. The article also says that the CBI may also refer any case to the board when the CBI has any issue or difficulty in technical matters with the concerned bank. For checking the bank frauds in July 2019, the government had issued framework for timely detection, reporting, investigation relating to large value bank frauds to public sector banks. It stated that all accounts exceeding Rs. 50 crore if classified as non-performing assets can be examined by banks from the angle of possible fraud. And a report has to be placed before the bank's committee for review of NPAs on the findings of this investigation.  A bank fraud is a criminal offense, whereas a non-performing asset or NPA is a loan or advance in which the interest or installments of the principal amount remain as overdue for over 90 days. Now based on this framework which was issued in July, this ABBF has been constituted by Central Vigilance Commission. So now let us see some facts about Central Vigilance Commission. It was established in the year 1964. It was established with the aim of addressing corrupt practices within the government. It gives advice and guidance to central government agencies in the field of vigilance. It was set up on the recommendations of Committee on Prevention of Corruption which is famously known as Santanam Committee. The Central Vigilance Commission is responsible for monitoring all vigilance activities under the union government. Also know that the Central Vigilance Commission is a statutory body under the Central Vigilance Act of 2003. And it is also an autonomous body and it is not under any ministry. It was conceived to be the APEX Vigilance Institution which is free of control from any executive authority and which can monitor all vigilance activity under the central government. With this we have come to the end of this article discussion. This practice question will be discussed in the next session. Moving on to the last session for the day that is the practice questions discussion session. In this first question two statements have been given and we have to choose the correct statement. The first statement states the National Commission for the Protection of Child Rights is a constitutional body. Now this statement is wrong because the National Commission for the Protection of Child Rights that is the NCPCR is a statutory body because it was established by the Commission for the Protection of Child Rights Act of 2005. So we know that it is not established based on the provisions in constitution. So it is not a constitutional body. This statement is wrong. If you see the next statement it states the Commission can inquire into the violation of child rights by Suomoto. Now during our discussion we saw that one of the functions of NCPCR is to inquire into the complaints about the violation of child rights, non-implementation of laws, policies for the protection of child rights. We also saw that it can inquire on its own without anyone making any formal complaint or reporting of violations to the Commission. Now this inquiry is called as Suomoto which is inquiring on its own. So this statement is correct. Here statement two is the correct statement. So the final answer to this question is option B2 only. Now this next question states in each of the following states the share of MICA with respect to the country's total MICA resources is maximum. Four states have been given Andhra Pradesh, Udisha, Bihar, Jharkhand. During our discussion we saw that Bihar and Jharkhand together account for 3% of MICA resources found in the country. And we also saw that Andhra Pradesh accounts for 41% of MICA resources found in the country which is the maximum. So the correct answer to this question is option A Andhra Pradesh. Also know that the second state which has most MICA resources is Rajasthan which is followed by Udisha. This question is based on special data dissemination standard. It states the question asks that this data standard initiative is established by which of the following organizations. Four organizations have been given and based on today's discussion we clearly know that the special data dissemination standard or SDDS initiative is established by International Monetary Fund or IMF. During discussion we have seen some important data standard initiatives taken by IMF to bring data transparency in member countries. And in the year 1996 it introduced special data dissemination standard. So the correct answer to this question is option B International Monetary Fund. This question is with respect to blue whales. Three statements have been given and we have to choose the correct statement. The first statement states they are found in Indian Ocean only. Now during our discussion we saw that the blue whale is a cosmopolitan species which means it is found all over the world. And we also saw that these blue whales are found in all oceans except in some regional seas such as the Mediterranean Sea, Ocastoc Sea and Bering Sea. So this means this statement is wrong. Now as the first statement is wrong you can eliminate option A and option B. Now the second statement states it is listed as critically endangered by the IUCN Red List. Now as of now it is listed as endangered in the IUCN Red List of threatened species. This is because of the effective implementation of conservation measures which are helping in the slow recovery of the blue whale population. So this statement is also wrong which means statement 3 is the correct statement and option C is the correct answer to this question. Now also know that it is protected under schedule 1 of Wildlife Protection Act of 1972. This next question is based on advisory board for banking frauds. Two statements have been given and we have to choose the correct statement. This statement states it was constituted by Central Vigilance Commission in consultation with the RBI. Yes, this statement is correct. It was constituted by Central Vigilance Commission. It was formed after reconstituting and renaming the advisory board on bank, commercial and financial frauds and it was formed after the consultation with the RBI. So this statement is correct. The second statement states its objective is to examine large bank frauds of over Rs. 50 crore and recommend action. Now this statement is also correct because this board was formed based on the framework that was issued by the central government which stated that all accounts exceeding Rs. 50 crore if classified as non-performing assets can be examined by banks from the angle of possible fraud. For this purpose only this board was constituted. So this statement is also correct. Here both the statements are correct. So the final correct answer to this question is option C both 1 and 2. This next question is based on Central Vigilance Commission and we have to choose the correct statement. The first statement states it was constituted based on the recommendations of the Guttgill Commission. Now this statement is wrong because we saw Guttgill Commission with respect to Kerala flood open editorial. In that we mentioned that Madhav Guttgill was the chairman of Western Guards Ecology Export Panel which was also called as Guttgill Commission. So this means Guttgill Commission was based on Western Guards Ecology Export Panel. It was an environment related panel but we know that Central Vigilance Commission is set up for addressing the corrupt practices within the government. So that means Central Vigilance Commission has to be based on a committee which was on the prevention of corruption and this committee on prevention of corruption is called as Santanam Committee not Guttgill Commission. So this statement is wrong. Now the second statement states it is an autonomous statutory body. Now first we have to in this statement two things have been given. First we have to know whether it is an autonomous body and second whether it is a statutory body. It is an autonomous body because CVC was conceived to be the Apex Vigilance Institution which is free of control from any executive authority for monitoring all Vigilance activity under the central government. Now second whether it is a statutory body. Yes it is a statutory body. It was given statutory status based upon the permulgation of an ordinance by the President. This ordinance made the Central Vigilance Commission a multi-member commission in the year 1998. Then in 2003 the Central Vigilance Bill was passed by both the houses of the Parliament and the President gave assent in September 2003. So based on this the Central Vigilance Commission Act of 2003 came into effect. Now under this Act the Central Vigilance Commission continues to be a statutory body. So this statement is correct. The third statement states it comes under Ministry of Home Affairs. Now during our discussion we mentioned that it does not come under any ministry. So this statement is wrong. The question asks for the correct statement. Here statement 2 is the only correct statement. So the final correct answer to this question is option B2 only. Now let us see one mains question based on GS paper 2. Kerala has witnessed back to back floods that resulted in heavy financial losses and human tragedies. In this context discuss the relevance of Gadgil commission report and the importance of a bottom up approach in the conservation of nature. Now with respect to this first statement you can say that in the year 2018 Kerala witnessed devastating floods and landslides which resulted in huge financial losses and human tragedies and this also repeated in 2019. Now the actual question is discuss the relevance of Gadgil commission report and the importance of bottom up approach in conservation of nature. So now for this you can say that the Gadgil commission report which is the western guards ecology expert panel report has given some recommendations based on which if it was implemented the losses could have been reduced. Now the recommendations include the devolution of powers from the state government to the gram sabha and ward level. Now this is known as the bottom up approach. Now this recommendation was given because Kerala leads the country in democratic devolution of power and it has a strong local self-government and to substantiate this point you can mention the Plachimada agitation against the Coca-Cola company. Then you can mention the statement given by the Kerala High Court which stated that the grassroots institutions have authority to decide on the course of development in their own locality. Now this reiterates the importance of a bottom up approach that is the role of people in conservation of nature. Then you can also say that this report also recommended to replace the prevailing develop recklessly conserved thoughtlessly pattern with develop sustainably conserved thoughtfully. Then there were also recommendations to demarcate areas within western guards as ecologically sensitive zones under the environment protection act of 1986. Then you can also say this demarcation will be based on the indicators of sensitivity which are elevation slope and the extent and quality of natural vegetation. Now this is only possible when people engage themselves more actively in the governance of the country and lead it to a path of people friendly and nature friendly development. Then finally you can also add your own viewpoints based on today's discussion. With this we have come to the end of article discussions and question answer discussion sessions. If you like the video don't forget to like comment and share and do subscribe to Shankar IAS Academy YouTube channel for more updates related to civil service examination preparation.


Hi guys, I am Mohit Sabarwal and here are the top 4 funding news of the week. China's ride-hailing company Didi has invested $100 million in oil. With this, OEO's $1 billion round of financing comes to a close. Singapore-based fashion e-commerce platform Zilingo has raised a funding of $2.25 million by Sequa Capital. The company will utilize the fund to enhance its infrastructure and develop technology to optimize its fashion supply chain. New banking startup Open has raised $5 million funding. The company will utilize the fund to upscale its team and launch new products. Investment platform Smallcase has raised $8 million in funding led by Sequa India. The online equity platform will utilize the fund to enhance its infrastructure to offer retail brokers with theme-based investments.


Democrats are violent extremists. Republicans are up in arms over remarks from the White House depicting the Trump-aligned faction of their party as extremist, which Press Secretary Karin Jean-Pierre defended Thursday by saying that MAGA Republicans are extremists because they disagree with the majority of Americans. When you are not with what majority of Americans are, then you know that is extreme. That is an extreme way of thinking, Jean-Pierre said. Every part of this controversy is hilarious, from Republicans thinking that they are not extremists to anyone thinking that MAGA Republicans are meaningfully different from generic brand Republicans to Democrats thinking that they are any less extremist from MAGA Republicans to Jean-Pierre claiming that you are extremist if you don't agree with mainstream political consensus in the United States. If you look into who is inflicting the most violence, terrorism, and tyranny upon the largest number of people in our world, it's clear from the numbers that the worst offender by far is not fringe neo-Nazi groups, nor violent jihadists, nor communists, nor anarchists, nor environmentalists, nor incels, but the bipartisan political consensus of the US centralized empire. No other power has spent the 21st century killing people by the millions in wars of aggression. No other power is circling the planet with hundreds of military bases and working continuously to destroy any government which disobeys it. No other power is starving entire populations with economic sanctions, military blockades, and brazen theft. No other power has been interfering in foreign elections anywhere near as often. No other power is terrorizing populations around the world with wars, covert ops, drone strikes, proxy conflicts, and staged coups and uprisings. No other power is using its military, economic, diplomatic, and media dominance to bully the world into serving its interests. The only reason the mainstream views espoused by Democrats and Republicans are mainstream is because massive amounts of narrative management have gone into creating that consensus. The fact that the social engineers of the oligarchic empire have poured vast fortunes into making Americans consent to capitalism, corruption, militarism, and murder is the only reason those perspectives are so mainstream that they can be labeled moderate or centrist. When people hear the word extremist, they tend to think of groups like ISIS or the Ku Klux Klan. But per definition, an extremist is just someone whose political or religious beliefs can lead them to do violent or illegal things. The U.S. empire would crumble if it didn't do violent and illegal things continuously, which is why its body count dwarfs those of the extremist ideologies the news media tell us to worry about. And it is fully supported by both Republicans and Democrats. To pick a recent illustration of essentially limitless possible examples, imagine what the response would have been if a prominent MAGA pundit had given an award to neo-Nazis at an event hosted by the U.S. military during the Trump administration. Imagine how Democrats and their aligned media would have responded to such an event. Can you picture it? Can you hear the shrieking in your mind's ear? Good. Because that's exactly what happened at the Pentagon's annual Warrior Games at Disney World a few days ago. Only it was a liberal pundit and Ukrainian Nazis during the Biden administration. In a new report titled John Stuart and the Pentagon Honor Ukrainian Nazi at Disney World, the Grey Zones Alex Rubenstein shows the former Daily Show star presenting an award to a member of Ukraine's neo-Nazi Azov battalion who is wearing a t-shirt and a suspicious-looking red sleeve on one of his arms, with another photo showing the same Azov member a tattoo of a Nazi symbol on that same arm. Rubenstein presents evidence that this wasn't the only Nazi-affiliated Ukrainian at the event, which was also attended by musician Darius Rucker. I keep thinking I've seen the most liberal thing that could possibly happen, but 2022 keeps proving me wrong. I have a hard time imagining how you beat a liberal comedian honoring a Ukrainian Nazi with an award at a Pentagon event in Disneyland, but I'm sure they'll find a way before long. Biden is advancing the interests of the murderous US Empire by waging a world-threatening proxy war in Ukraine whose combatants can't seem to get photographed without Nazi insignia on their person. Trump advanced the interests of the US Empire by inflicting death and starvation in nations like Yemen, Venezuela, Iran, and Syria, as well as ramping up the brinkmanship with Russia, which led to the current proxy war in Ukraine. The Biden administration is the Trump administration with a different soundtrack. The Trump administration was the Obama administration with a different soundtrack. They are all violent extremists. None are superior to the other. They all serve the interests of the most murderous and depraved institution on Earth, as does anyone who supports any of them. Democrats calling Republicans extremists is like ISIS calling al-Qaeda extremists. Only Democrats and Republicans have a much higher body count.


It's gonna be incredible to my right. Y'all know this motherfucker a class give it up Shout out hunger games all day bought them all for one. Oh, yeah I shot away from LA man. Everybody in this building right now a patchy cafe make some noise right now I'm one on dead man whenever you're ready, bro.  Make you a hollow Jen. We'll take class I have a big coat following with the brisk don't like gum bars, huh?  We open up with the long mags. Let me home school. The sun's coming to pop class You from Baltimore boom that's TNT an Asian nigga that crashes in the DMV Right charge when he's behind the wheel is your potty behind bars You so asian when you play Grand Theft Auto and you hop into a swipe card Automatic five stars the mask is on. Yeah, the black range earth master's on the sun's to strap you're gone My fifth please a fifth that bad boy getting class like G suggests It can't pop with bigger things.    I see you pupils that bad Let's go with console that gun down victim I gun down victim and you're gonna be first class ever in front I'm gonna come out tripping two part of the court and shooting.   That's mine I said listen about the traumatize you ain't know how those buy you when your voice sounds like jaren riding through a mcdonald's drive through I could slide you give you more hits than the channel these battles get monetized through I got guys who I said the channel these battles get monetized through I got guys who stomp you out behind the scenes watching you shouting on fam dim set money house you off cam I know the suns you heard that I said you know the suns the suns ain't counting off grand then kids is just poorer all my players from seattle They got ranch on the corner buck fifty highlight split through his oyster. I just whipped dead vehicular slaughter I said homie your vocal tone sounds like a broken mobile phone I said your vocal tone sounds like a broken mobile phone.  You've been killed.   They shot They shot your liver and roll with the 12 steady AA rapid fire shot. He has mosh teams with the AA What battery you got in your bag let an AA of course don't make it rain in the club We had to squeeze lead because I got a piece so big that's what she said Now some odd she a busy group Bitch get more happy endings than disney movies That's why we raise different don't talk about gripping usies. That's why we raise different Don't talk about gripping usies. You never let the gun spit.  You got short genie like high waters niggas calling foot and monsters You a dwarf and rookie They skip class and the sport was hooky.    That's jim rom We know qp and fox left the clips go you making up a story.  We know the suns help you practice doesn't help or hurt your coach get bagged expensive purse Yo, I said your coach get bagged expensive purse. Tell him.  I sent a curse Dead man's family. I said dead man's family planted a funeral because the tech of burst and that's funny They're from letting it sing is why they went to church Answer me this question qp's a prostitute. Has he been to the hospital lately? I said qp's a prostitute. Has he been to the hospital lately? There's no way y'all could possibly take me on the mike j fox looking shaky I said for the suns we know conceded left conceded left for the mdv pay You caught that?   They like sniff.   It's cacky and euthanized Straight up crucified. You knock from the gutter.  You see when black people get oppressed by the man We either have rights or rather than be whole science When aging people get oppressed by the man is so sorry so so sorry When black people have beef in the streets, we run to the eat with a little ring When aging people have beef in the streets, they run to police.  Yo look at what an L.E. is.   We'll let them arms fly like mosh pits Big nose get ready the kid like caustic.   I mean speaking tongues or head bomb and she blew my sister king doesn't come But I just hit it and run. I'm doing you a favor. He need a round of the kuchi and sushi flavor She come to america don't move here later. Funny. I put her to sleep because she grew up in the euthanasia Bitch got jungle fever tag team.    You want mushroom to fire flower? He told bro.  Because I get a green screen and it's got the face of a background If they seen rock in the corner, it would smack down It's kind of get money like a cash cow.  I go crazy. He on cue nuts Always talking about how the clock is smoke.  They should be on the woman's ufc getting on the scales Oh y'all ain't get the punch. Okay. I'm saying you're not a comedian.  You need to vomit nose.   This motherfucker. I'm not trying to hear What's wrong, sonny? Come on, man. I'm not trying to hear about my clock in my 40 Motherfucker, if I see your girl, I'm a side of my shorty. Why you gotta be battling this dude I am not in my 40s and I'm paid for my flight. What you got on my 40? Okay, that's hunger game, sonny.