WEBVTT

1
00:00:17.775 --> 00:00:19.605
<00:00:17.775>Maybe <00:00:18.055>I'll <00:00:18.334>just <00:00:18.615>introduce <00:00:18.895>myself <00:00:19.174>quickly.

2
00:00:19.865 --> 00:00:21.925
<00:00:19.865>Uh, <00:00:20.064>I've <00:00:20.264>been <00:00:20.465>developing <00:00:20.665>for <00:00:20.865>all <00:00:21.064>my <00:00:21.264>life,

3
00:00:21.925 --> 00:00:23.245
<00:00:21.925>which <00:00:22.123>has <00:00:22.321>been <00:00:22.519>quite <00:00:22.717>a <00:00:22.915>while <00:00:23.113>now.

4
00:00:24.005 --> 00:00:26.685
<00:00:24.005>I <00:00:24.121>would <00:00:24.238>say <00:00:24.355>I, <00:00:24.471>I, <00:00:24.588>I <00:00:24.705>wrote <00:00:24.821>my <00:00:24.938>first <00:00:25.055>code <00:00:25.171>back <00:00:25.288>in <00:00:25.404>the

5
00:00:26.925 --> 00:00:29.085
<00:00:26.925>eighties, <00:00:28.325>uh,

6
00:00:29.705 --> 00:00:32.165
<00:00:29.705>and <00:00:29.904>I've <00:00:30.104>been <00:00:30.305>doing <00:00:30.505>security <00:00:30.705>also <00:00:30.904>now <00:00:31.104>for

7
00:00:32.755 --> 00:00:34.285
<00:00:32.755>well <00:00:32.984>over <00:00:33.214>10, <00:00:33.443>10 <00:00:33.673>years, <00:00:33.902>I <00:00:34.132>guess.

8
00:00:35.585 --> 00:00:39.685
<00:00:35.585>So <00:00:35.725>it <00:00:35.865>lends <00:00:36.005>very <00:00:36.145>nicely <00:00:36.285>to, <00:00:36.425>to, <00:00:36.565>to <00:00:36.705>integrating <00:00:36.845>the <00:00:36.985>concept

9
00:00:39.945 --> 00:00:43.365
<00:00:39.945>of <00:00:40.178>security <00:00:40.411>and <00:00:40.645>development <00:00:40.878>under <00:00:41.111>one <00:00:41.345>hat.

10
00:00:43.985 --> 00:00:46.725
<00:00:43.985>And <00:00:44.185>I'll <00:00:44.385>start <00:00:44.585>with <00:00:44.785>a <00:00:44.985>couple <00:00:45.185>of <00:00:45.385>mems,

11
00:00:46.865 --> 00:00:49.165
<00:00:46.865>so <00:00:47.005>it <00:00:47.145>might <00:00:47.285>calm <00:00:47.425>me <00:00:47.565>down <00:00:47.705>a <00:00:47.845>bit <00:00:47.985>from <00:00:48.125>my <00:00:48.265>nervousness.

12
00:00:49.425 --> 00:00:50.445
<00:00:49.425>Uh, <00:00:49.884>lemme <00:00:50.343>see.

13
00:00:52.585 --> 00:00:55.965
<00:00:52.585>So <00:00:52.935>this <00:00:53.285>is <00:00:53.635>really, <00:00:53.985>uh,

14
00:00:59.525 --> 00:01:00.615
<00:00:59.525>okay, <00:00:59.770>so <00:01:00.015>there <00:01:00.260>we <00:01:00.506>go.

15
00:01:01.315 --> 00:01:03.095
<00:01:01.315>Now, <00:01:01.489>now <00:01:01.665>I, <00:01:01.839>I'm <00:01:02.015>also <00:01:02.190>in <00:01:02.364>the <00:01:02.540>right <00:01:02.714>window.

16
00:01:05.115 --> 00:01:08.775
<00:01:05.114>So <00:01:05.231>once <00:01:05.348>upon <00:01:05.464>a <00:01:05.581>time, <00:01:05.698>I <00:01:05.815>sure <00:01:05.931>most <00:01:06.048>of <00:01:06.164>you <00:01:06.281>knew <00:01:06.398>this <00:01:06.515>problem.

17
00:01:09.285 --> 00:01:10.455
<00:01:09.285>Some <00:01:10.338>are.

18
00:01:10.455 --> 00:01:15.135
<00:01:10.455>A <00:01:10.610>lot <00:01:10.766>of <00:01:10.921>companies <00:01:11.077>I <00:01:11.232>still <00:01:11.388>consult <00:01:11.543>today, <00:01:11.699>they, <00:01:11.855>they,

19
00:01:15.135 --> 00:01:16.415
<00:01:15.135>they <00:01:15.423>still <00:01:15.711>operate <00:01:15.999>like <00:01:16.286>this.

20
00:01:16.955 --> 00:01:21.855
<00:01:16.955>So <00:01:17.130>nicely <00:01:17.304>developed, <00:01:17.480>works <00:01:17.655>on <00:01:17.830>staging, <00:01:18.005>pushed <00:01:18.179>to <00:01:18.355>prod,

21
00:01:22.035 --> 00:01:23.375
<00:01:22.035>and <00:01:22.336>then <00:01:22.638>it's <00:01:22.939>ops <00:01:23.241>problem.

22
00:01:23.715 --> 00:01:25.815
<00:01:23.715>It <00:01:23.915>doesn't <00:01:24.115>matter <00:01:24.315>what <00:01:24.515>goes <00:01:24.715>on, <00:01:24.915>it <00:01:25.115>just,

23
00:01:25.815 --> 00:01:26.855
<00:01:25.815>let's <00:01:26.048>give <00:01:26.283>it <00:01:26.517>to <00:01:26.751>ops.

24
00:01:28.515 --> 00:01:30.735
<00:01:28.515>Uh, <00:01:28.715>how <00:01:28.915>do <00:01:29.115>we <00:01:29.315>get <00:01:29.515>to <00:01:29.715>DevOps <00:01:29.915>anyway?

25
00:01:30.895 --> 00:01:33.615
<00:01:30.895>I <00:01:31.035>mean, <00:01:31.175>there's <00:01:31.315>a, <00:01:31.455>probably <00:01:31.595>all <00:01:31.735>of <00:01:31.875>you <00:01:32.015>have <00:01:32.155>an <00:01:32.295>opinion,

26
00:01:33.835 --> 00:01:37.895
<00:01:33.835>you <00:01:33.975>know, <00:01:34.115>did <00:01:34.255>it <00:01:34.395>do <00:01:34.535>a <00:01:34.675>ci <00:01:34.815>cd <00:01:34.955>platform <00:01:35.095>and <00:01:35.235>tools?

27
00:01:38.355 --> 00:01:39.975
<00:01:38.354>Was <00:01:38.704>it <00:01:39.054>continuous <00:01:39.404>automated <00:01:39.755>testing,

28
00:01:39.985 --> 00:01:41.215
<00:01:39.985>which <00:01:40.261>made <00:01:40.538>it <00:01:40.815>a <00:01:41.092>success?

29
00:01:42.555 --> 00:01:45.175
<00:01:42.555>Was <00:01:42.905>it <00:01:43.255>automating <00:01:43.605>infrastructure, <00:01:43.955>delivery,

30
00:01:45.275 --> 00:01:46.815
<00:01:45.275>or <00:01:45.552>even <00:01:45.829>infrastructure <00:01:46.106>as <00:01:46.383>a <00:01:46.661>code?

31
00:01:48.425 --> 00:01:52.915
<00:01:48.425>In <00:01:48.600>my <00:01:48.774>personal <00:01:48.950>opinion, <00:01:49.125>I <00:01:49.300>still <00:01:49.475>think <00:01:49.649>the <00:01:49.825>biggest

32
00:01:54.385 --> 00:01:57.595
<00:01:54.384>kind <00:01:54.734>of <00:01:55.085>enabler <00:01:55.434>is <00:01:55.785>culture.

33
00:01:59.895 --> 00:02:02.355
<00:01:59.895>So <00:02:00.035>without <00:02:00.175>the <00:02:00.315>right <00:02:00.455>culture, <00:02:00.595>you <00:02:00.735>can <00:02:00.875>have <00:02:01.015>as <00:02:01.155>many <00:02:01.295>tools

34
00:02:02.415 --> 00:02:04.715
<00:02:02.415>and <00:02:02.590>processes <00:02:02.765>as <00:02:02.940>you, <00:02:03.115>as <00:02:03.290>you, <00:02:03.465>as <00:02:03.640>you <00:02:03.815>wish.

35
00:02:05.655 --> 00:02:08.035
<00:02:05.655>DevOps <00:02:06.005>will <00:02:06.355>not <00:02:06.705>necessarily <00:02:07.055>succeed.

36
00:02:09.415 --> 00:02:13.235
<00:02:09.414>But <00:02:09.590>having <00:02:09.764>said <00:02:09.940>this, <00:02:10.114>there's <00:02:10.289>still <00:02:10.465>a <00:02:10.639>silo <00:02:10.815>left.

37
00:02:16.105 --> 00:02:19.405
<00:02:16.105>Now. <00:02:16.385>I <00:02:16.665>don't <00:02:16.945>think <00:02:17.225>we'll <00:02:17.505>get

38
00:02:21.125 --> 00:02:23.015
<00:02:21.125>security <00:02:22.525>silo

39
00:02:23.435 --> 00:02:26.895
<00:02:23.435>as <00:02:23.635>far <00:02:23.835>in <00:02:24.035>to <00:02:24.235>go <00:02:24.435>back <00:02:24.635>a <00:02:24.835>second.

40
00:02:26.905 --> 00:02:31.815
<00:02:26.905>Sorry. <00:02:27.032>Security <00:02:27.159>is, <00:02:27.286>it <00:02:27.414>is <00:02:27.541>a <00:02:27.668>huge, <00:02:27.795>huge <00:02:27.923>area <00:02:28.050>at <00:02:28.177>the <00:02:28.305>moment.

41
00:02:31.955 --> 00:02:36.095
<00:02:31.954>If <00:02:32.094>we, <00:02:32.234>if <00:02:32.374>we <00:02:32.515>look <00:02:32.654>at <00:02:32.795>the <00:02:32.934>entire <00:02:33.075>cloud <00:02:33.214>scenario, <00:02:33.355>uh,

42
00:02:36.555 --> 00:02:40.855
<00:02:36.555>if <00:02:36.788>you <00:02:37.021>are <00:02:37.255>discussing, <00:02:37.488>uh, <00:02:37.721>home <00:02:37.955>office,

43
00:02:41.355 --> 00:02:45.095
<00:02:41.355>uh, <00:02:41.588>digital <00:02:41.821>nomads, <00:02:42.054>people <00:02:42.288>working <00:02:42.521>from <00:02:42.755>anywhere,

44
00:02:45.095 --> 00:02:47.975
<00:02:45.095>everywhere <00:02:45.250>in <00:02:45.406>the <00:02:45.561>world, <00:02:45.717>this <00:02:45.872>is <00:02:46.028>not <00:02:46.183>a <00:02:46.339>security <00:02:46.495>issue.

45
00:02:47.995 --> 00:02:50.455
<00:02:47.995>We <00:02:48.170>can, <00:02:48.345>we <00:02:48.520>can, <00:02:48.695>we <00:02:48.870>can <00:02:49.045>tackle <00:02:49.220>from <00:02:49.395>the,

46
00:02:50.925 --> 00:02:52.175
<00:02:50.925>from <00:02:51.300>the <00:02:51.675>development <00:02:52.050>side,

47
00:02:52.835 --> 00:02:55.455
<00:02:52.835>but <00:02:53.010>at <00:02:53.185>least <00:02:53.360>when <00:02:53.535>we <00:02:53.710>talk <00:02:53.885>about <00:02:54.060>workload <00:02:54.235>protection.

48
00:02:55.675 --> 00:02:58.335
<00:02:55.675>So <00:02:55.908>protecting <00:02:56.141>our <00:02:56.375>workloads, <00:02:56.608>protecting <00:02:56.841>our, <00:02:57.075>our,

49
00:02:58.515 --> 00:02:59.685
<00:02:58.515>our <00:02:59.568>deliverables,

50
00:03:00.985 --> 00:03:04.045
<00:03:00.985>it <00:03:01.218>is <00:03:01.451>something <00:03:01.685>which <00:03:01.918>we <00:03:02.151>should <00:03:02.385>have

51
00:03:04.045 --> 00:03:05.165
<00:03:04.045>to <00:03:04.297>pay <00:03:04.548>more <00:03:04.801>attention <00:03:05.053>to.

52
00:03:06.265 --> 00:03:08.925
<00:03:06.265>So <00:03:06.498>it's <00:03:06.731>all <00:03:06.964>about <00:03:07.198>left <00:03:07.431>shifting <00:03:07.665>security.

53
00:03:09.675 --> 00:03:11.845
<00:03:09.675>I'll <00:03:09.815>come <00:03:09.955>back <00:03:10.095>and <00:03:10.235>talk <00:03:10.375>a <00:03:10.515>little <00:03:10.655>bit <00:03:10.795>about <00:03:10.935>that <00:03:11.075>later.

54
00:03:12.515 --> 00:03:15.005
<00:03:12.515>What <00:03:12.795>I <00:03:13.075>mean <00:03:13.355>with <00:03:13.635>that. <00:03:13.915>Plus,

55
00:03:16.155 --> 00:03:18.325
<00:03:16.155>I've <00:03:16.388>had <00:03:16.621>these <00:03:16.855>discussions <00:03:17.088>several <00:03:17.321>times <00:03:17.555>now

56
00:03:18.325 --> 00:03:19.485
<00:03:18.325>over <00:03:18.533>the <00:03:18.742>last <00:03:18.951>couple <00:03:19.160>of <00:03:19.369>years.

57
00:03:19.505 --> 00:03:23.525
<00:03:19.505>You <00:03:19.680>know, <00:03:19.855>is <00:03:20.030>it <00:03:20.204>SEC <00:03:20.380>DevOps? <00:03:20.555>Is <00:03:20.730>it <00:03:20.905>DevSecOps?

58
00:03:24.105 --> 00:03:25.605
<00:03:24.105>Is <00:03:24.554>it <00:03:25.005>secure? <00:03:25.454>DevOps?

59
00:03:27.665 --> 00:03:29.685
<00:03:27.665>We <00:03:28.015>picked <00:03:28.364>DevSecOps, <00:03:28.715>but <00:03:29.065>basically

60
00:03:29.685 --> 00:03:33.725
<00:03:29.685>because <00:03:29.825>it <00:03:29.965>lent <00:03:30.105>itself <00:03:30.245>to <00:03:30.385>kind <00:03:30.525>of <00:03:30.665>a <00:03:30.805>cool <00:03:30.945>logo <00:03:31.085>anyway.

61
00:03:33.725 --> 00:03:36.045
<00:03:33.725>But <00:03:33.864>I <00:03:34.005>think <00:03:34.144>for <00:03:34.285>me, <00:03:34.424>it <00:03:34.565>all <00:03:34.704>means <00:03:34.845>the <00:03:34.984>same <00:03:35.125>thing,

62
00:03:36.795 --> 00:03:39.725
<00:03:36.795>integrating <00:03:37.075>security <00:03:37.355>into <00:03:37.635>your <00:03:37.915>DevOps <00:03:38.195>lifecycle.

63
00:03:43.465 --> 00:03:46.045
<00:03:43.465>So <00:03:43.745>I've <00:03:44.025>picked <00:03:44.305>a, <00:03:44.585>uh, <00:03:44.865>simple

64
00:03:46.925 --> 00:03:49.005
<00:03:46.925>software <00:03:47.100>development <00:03:47.275>lifecycle <00:03:47.450>here, <00:03:47.625>which <00:03:47.800>I'd <00:03:47.975>like <00:03:48.150>to <00:03:48.325>go

65
00:03:49.005 --> 00:03:50.245
<00:03:49.005>to <00:03:49.191>in <00:03:49.377>a <00:03:49.563>little <00:03:49.749>bit <00:03:49.935>more <00:03:50.121>detail.

66
00:03:52.185 --> 00:03:54.785
<00:03:52.185>Uh, <00:03:52.418>let's <00:03:52.651>start <00:03:52.885>at <00:03:53.118>the <00:03:53.351>very <00:03:53.585>beginning.

67
00:03:56.225 --> 00:03:57.385
<00:03:56.225>I <00:03:56.572>picked <00:03:56.921>this, <00:03:57.269>ma'am

68
00:03:57.385 --> 00:04:02.065
<00:03:57.385>because, <00:03:57.560>uh, <00:03:57.734>uh, <00:03:57.910>everybody's <00:03:58.084>talking <00:03:58.260>about <00:03:58.435>MVPs, <00:03:58.609>MVP <00:03:58.785>here,

69
00:04:02.345 --> 00:04:06.505
<00:04:02.345>MVP, <00:04:02.472>there <00:04:02.599>for <00:04:02.726>me, <00:04:02.854>it's <00:04:02.981>become <00:04:03.108>more <00:04:03.235>of <00:04:03.363>a, <00:04:03.490>it <00:04:03.617>means, <00:04:03.745>uh,

70
00:04:06.535 --> 00:04:09.625
<00:04:06.535>maximum <00:04:06.815>functionality <00:04:07.095>to <00:04:07.375>a <00:04:07.655>minimum <00:04:07.935>price.

71
00:04:12.815 --> 00:04:15.675
<00:04:12.815>But <00:04:13.048>let's <00:04:13.281>talk <00:04:13.515>a <00:04:13.748>bit <00:04:13.981>about <00:04:14.215>requirements

72
00:04:15.895 --> 00:04:19.195
<00:04:15.895>or <00:04:16.022>what <00:04:16.149>happens <00:04:16.276>at <00:04:16.404>this <00:04:16.531>stage <00:04:16.658>in <00:04:16.785>the, <00:04:16.913>uh, <00:04:17.040>in <00:04:17.167>the <00:04:17.295>lifecycle.

73
00:04:22.495 --> 00:04:23.255
<00:04:22.495>I <00:04:22.666>do <00:04:22.837>a <00:04:23.008>lot <00:04:23.179>of,

74
00:04:37.365 --> 00:04:39.305
<00:04:37.365>um, <00:04:38.765>it's,

75
00:04:39.935 --> 00:04:40.705
<00:04:39.935>It's <00:04:40.628>the

76
00:04:48.485 --> 00:04:50.805
<00:04:48.485>Functionality <00:04:48.718>or <00:04:48.951>part <00:04:49.185>of <00:04:49.418>an <00:04:49.651>nd <00:04:49.885>uh,

77
00:04:51.445 --> 00:04:53.205
<00:04:51.445>I <00:04:51.724>disagree <00:04:52.005>here. <00:04:52.284>So <00:04:52.565>we <00:04:52.844>can

78
00:04:53.625 --> 00:04:53.845
Put

79
00:04:57.215 --> 00:04:58.845
<00:04:57.215>Hacks, <00:04:57.448>whatever <00:04:57.681>you'd <00:04:57.915>like <00:04:58.148>to <00:04:58.381>call <00:04:58.615>them.

80
00:04:59.705 --> 00:05:01.765
<00:04:59.705>But <00:05:00.055>it's <00:05:00.405>an <00:05:00.755>important <00:05:01.104>aspect,

81
00:05:02.095 --> 00:05:04.925
<00:05:02.095>which <00:05:02.328>in <00:05:02.561>my <00:05:02.795>opinion <00:05:03.028>should <00:05:03.261>be <00:05:03.495>tackled

82
00:05:06.025 --> 00:05:07.525
<00:05:06.025>at <00:05:06.250>the <00:05:06.474>beginning <00:05:06.700>of <00:05:06.924>your <00:05:07.150>life <00:05:07.375>cycle.

83
00:05:08.315 --> 00:05:10.685
<00:05:08.315>Because <00:05:08.548>if <00:05:08.781>you <00:05:09.015>don't <00:05:09.248>actively <00:05:09.481>attack <00:05:09.715>them,

84
00:05:10.795 --> 00:05:13.245
<00:05:10.795>they <00:05:10.935>will <00:05:11.075>probably <00:05:11.215>come <00:05:11.355>back <00:05:11.495>at <00:05:11.635>some <00:05:11.775>point <00:05:11.915>in <00:05:12.055>the <00:05:12.195>future

85
00:05:13.625 --> 00:05:14.885
<00:05:13.625>and <00:05:14.003>actively <00:05:14.381>attack <00:05:14.759>you.

86
00:05:16.625 --> 00:05:18.405
<00:05:16.625>That's <00:05:16.975>one <00:05:17.325>part <00:05:17.675>of <00:05:18.025>it.

87
00:05:18.705 --> 00:05:22.165
<00:05:18.705>And <00:05:18.938>I <00:05:19.171>also <00:05:19.405>believe <00:05:19.638>strongly, <00:05:19.871>if <00:05:20.104>you

88
00:05:23.535 --> 00:05:25.965
<00:05:23.535>understand, <00:05:23.768>of <00:05:24.001>course, <00:05:24.235>you <00:05:24.468>cannot <00:05:24.701>understand <00:05:24.935>there,

89
00:05:27.225 --> 00:05:32.105
<00:05:27.225>but, <00:05:27.458>uh, <00:05:27.691>if <00:05:27.925>you <00:05:28.158>try <00:05:28.391>to <00:05:28.625>understand

90
00:05:32.975 --> 00:05:34.745
<00:05:32.975>your <00:05:33.675>major <00:05:34.375>vulnerabilities,

91
00:05:37.485 --> 00:05:39.305
<00:05:37.485>it <00:05:37.835>will <00:05:38.185>have <00:05:38.535>a <00:05:38.885>positive

92
00:05:39.565 --> 00:05:39.985
Effect

93
00:05:44.925 --> 00:05:47.855
<00:05:44.925>on <00:05:46.325>how,

94
00:05:49.035 --> 00:05:51.615
<00:05:49.034>How <00:05:49.268>your <00:05:49.501>product, <00:05:49.734>how <00:05:49.968>your <00:05:50.201>software, <00:05:50.434>uh,

95
00:05:51.695 --> 00:05:53.015
<00:05:51.695>I <00:05:51.992>just <00:05:52.289>recently <00:05:52.586>was <00:05:52.883>part.

96
00:05:53.475 --> 00:05:55.455
<00:05:53.475>And <00:05:53.708>it <00:05:53.941>really <00:05:54.175>helped <00:05:54.408>us <00:05:54.641>to <00:05:54.875>understand

97
00:05:57.615 --> 00:06:00.585
<00:05:57.615>What <00:05:57.790>potential <00:05:57.965>danger <00:05:58.140>is <00:05:58.315>out <00:05:58.490>there <00:05:58.665>with <00:05:58.840>our <00:05:59.015>sensors,

98
00:06:00.585 --> 00:06:02.145
<00:06:00.585>especially <00:06:01.051>our <00:06:01.518>iot <00:06:01.984>sensors,

99
00:06:02.575 --> 00:06:06.425
<00:06:02.575>because <00:06:02.750>they're <00:06:02.925>usually <00:06:03.099>not <00:06:03.275>part <00:06:03.450>of <00:06:03.625>a <00:06:03.800>control <00:06:03.974>cloud.

100
00:06:06.895 --> 00:06:09.465
<00:06:06.895>They're, <00:06:07.070>we, <00:06:07.245>we <00:06:07.419>handed <00:06:07.594>them <00:06:07.770>over <00:06:07.945>to, <00:06:08.120>to, <00:06:08.294>to,

101
00:06:09.485 --> 00:06:11.345
<00:06:09.485>to <00:06:09.951>a <00:06:10.418>network <00:06:10.885>operator.

102
00:06:12.525 --> 00:06:16.345
<00:06:12.525>And <00:06:12.875>hardening <00:06:13.224>these <00:06:13.575>sensors <00:06:13.924>in

103
00:06:17.215 --> 00:06:21.905
<00:06:17.215>regards <00:06:17.414>towards <00:06:17.614>potential <00:06:17.815>attack <00:06:18.015>vectors <00:06:18.215>really <00:06:18.414>helped <00:06:18.614>us,

104
00:06:22.045 --> 00:06:25.625
<00:06:22.045>uh, <00:06:22.245>pick <00:06:22.445>a, <00:06:22.645>pick <00:06:22.845>a <00:06:23.045>strong, <00:06:23.245>strong <00:06:23.445>architecture.

105
00:06:26.285 --> 00:06:28.265
<00:06:26.285>And <00:06:26.565>another <00:06:26.845>interesting <00:06:27.125>thing <00:06:27.405>here, <00:06:27.685>which

106
00:06:29.465 --> 00:06:31.185
<00:06:29.465>I <00:06:29.698>just <00:06:29.931>came <00:06:30.164>across <00:06:30.398>recently <00:06:30.631>or, <00:06:30.864>or

107
00:06:31.185 --> 00:06:35.705
<00:06:31.185>or <00:06:31.360>realized <00:06:31.535>recently <00:06:31.710>is <00:06:31.885>abuse <00:06:32.060>cases <00:06:32.235>can <00:06:32.410>be <00:06:32.585>used

108
00:06:35.725 --> 00:06:40.105
<00:06:35.725>as <00:06:35.841>an <00:06:35.958>input <00:06:36.075>for <00:06:36.191>a <00:06:36.308>red <00:06:36.425>team, <00:06:36.541>if <00:06:36.658>you <00:06:36.775>have <00:06:36.891>one, <00:06:37.008>uh, <00:06:37.125>in

109
00:06:40.695 --> 00:06:43.745
<00:06:40.695>regarding <00:06:40.895>automated <00:06:41.094>pen <00:06:41.295>testing <00:06:41.495>or <00:06:41.695>manual <00:06:41.895>pen <00:06:42.094>testing.

110
00:06:44.365 --> 00:06:46.465
<00:06:44.365>So <00:06:44.565>basically <00:06:44.765>the <00:06:44.965>abuse <00:06:45.165>cases <00:06:45.365>are <00:06:45.565>nothing <00:06:45.765>else

111
00:06:46.645 --> 00:06:48.985
<00:06:46.645>but <00:06:46.878>your, <00:06:47.111>your, <00:06:47.344>your, <00:06:47.578>your <00:06:47.811>attack <00:06:48.044>vectors.

112
00:06:48.985 --> 00:06:52.625
<00:06:48.985>You're <00:06:49.125>gonna <00:06:49.265>be <00:06:49.405>testing <00:06:49.545>if <00:06:49.685>you <00:06:49.825>do <00:06:49.965>pen <00:06:50.105>testing <00:06:50.245>on <00:06:50.385>your,

113
00:06:52.645 --> 00:06:53.785
<00:06:52.645>on <00:06:52.986>your <00:06:53.328>production <00:06:53.671>system.

114
00:06:54.565 --> 00:06:56.385
<00:06:54.565>So <00:06:54.765>there <00:06:54.965>are <00:06:55.165>quite <00:06:55.365>a <00:06:55.565>few <00:06:55.765>benefits <00:06:55.965>to,

115
00:06:56.445 --> 00:06:58.545
<00:06:56.445>to <00:06:56.585>have <00:06:56.724>a <00:06:56.865>look <00:06:57.005>into <00:06:57.145>these <00:06:57.284>at <00:06:57.425>the <00:06:57.565>beginning <00:06:57.705>of <00:06:57.844>your,

116
00:06:58.565 --> 00:06:59.665
<00:06:58.565>uh, <00:06:59.060>development <00:06:59.555>cycle.

117
00:07:02.525 --> 00:07:03.745
<00:07:02.525>Now, <00:07:02.799>let's <00:07:03.074>go <00:07:03.348>to <00:07:03.623>design.

118
00:07:09.565 --> 00:07:10.865
<00:07:09.565>So <00:07:09.711>I'm <00:07:09.857>trying <00:07:10.003>to <00:07:10.150>make <00:07:10.296>a <00:07:10.442>joke <00:07:10.588>here <00:07:10.735>about

119
00:07:10.865 --> 00:07:11.905
<00:07:10.865>hybrid <00:07:11.099>clouds, <00:07:11.332>by <00:07:11.567>the <00:07:11.801>way.

120
00:07:11.905 --> 00:07:16.465
<00:07:11.905>Again, <00:07:12.060>it's <00:07:12.216>just <00:07:12.371>a <00:07:12.527>man <00:07:12.682>which <00:07:12.838>kind <00:07:12.993>of <00:07:13.149>suited <00:07:13.304>challenges.

121
00:07:17.565 --> 00:07:19.265
<00:07:17.565>DevOps, <00:07:18.265>cloud <00:07:18.965>computing,

122
00:07:19.515 --> 00:07:24.175
<00:07:19.515>cloud <00:07:20.215>deployment, <00:07:20.914>virtualization.

123
00:07:25.915 --> 00:07:29.015
<00:07:25.915>Uh, <00:07:26.115>it <00:07:26.315>lends <00:07:26.515>the <00:07:26.715>faster <00:07:26.915>deployment <00:07:27.115>increase <00:07:27.315>dynamics.

124
00:07:29.195 --> 00:07:34.055
<00:07:29.195>Uh, <00:07:29.322>we <00:07:29.449>can, <00:07:29.576>uh, <00:07:29.704>we <00:07:29.831>can, <00:07:29.958>we <00:07:30.085>can, <00:07:30.213>we <00:07:30.340>can <00:07:30.467>start, <00:07:30.594>stop,

125
00:07:34.155 --> 00:07:37.575
<00:07:34.155>uh, <00:07:34.621>containers, <00:07:35.088>processes, <00:07:35.554>uh,

126
00:07:39.075 --> 00:07:41.055
<00:07:39.075>uh, <00:07:39.541>lambda <00:07:40.008>functions, <00:07:40.474>whatever.

127
00:07:41.195 --> 00:07:42.775
<00:07:41.195>So <00:07:41.428>we <00:07:41.661>have <00:07:41.895>a <00:07:42.128>lot <00:07:42.361>more <00:07:42.594>workloads,

128
00:07:43.715 --> 00:07:46.735
<00:07:43.715>but <00:07:43.995>it's <00:07:44.275>something <00:07:44.555>we <00:07:44.835>can <00:07:45.115>control.

129
00:07:46.835 --> 00:07:49.655
<00:07:46.835>At <00:07:46.990>least <00:07:47.146>we're <00:07:47.301>getting <00:07:47.457>the <00:07:47.612>tools, <00:07:47.768>which <00:07:47.923>are <00:07:48.079>allowing <00:07:48.234>us

130
00:07:49.655 --> 00:07:51.375
<00:07:49.655>to <00:07:50.005>better <00:07:50.354>control <00:07:50.705>these <00:07:51.054>situations.

131
00:07:52.235 --> 00:07:56.435
<00:07:52.235>So <00:07:52.375>it's, <00:07:52.515>this <00:07:52.655>challenge <00:07:52.795>is <00:07:52.935>kind <00:07:53.075>of <00:07:53.215>taking <00:07:53.355>care <00:07:53.495>of <00:07:53.635>itself.

132
00:07:57.815 --> 00:07:59.595
<00:07:57.815>But <00:07:58.048>the <00:07:58.281>next <00:07:58.515>one, <00:07:58.748>this <00:07:58.981>is <00:07:59.215>becoming

133
00:07:59.705 --> 00:08:00.795
<00:07:59.705>more <00:08:00.032>and <00:08:00.359>more <00:08:00.686>challenging.

134
00:08:00.815 --> 00:08:04.635
<00:08:00.815>And <00:08:01.015>that's <00:08:01.215>the, <00:08:01.415>uh, <00:08:01.615>the <00:08:01.815>abstraction, <00:08:02.015>uh, <00:08:02.215>issue

135
00:08:04.635 --> 00:08:08.515
<00:08:04.635>that <00:08:04.835>basically <00:08:05.034>today <00:08:05.235>you <00:08:05.435>can <00:08:05.635>have <00:08:05.835>your <00:08:06.034>functionality

136
00:08:08.615 --> 00:08:12.915
<00:08:08.615>as <00:08:08.770>a <00:08:08.926>vm <00:08:09.081>m <00:08:09.237>tomorrow, <00:08:09.392>you <00:08:09.548>can <00:08:09.703>decide <00:08:09.859>to, <00:08:10.015>uh,

137
00:08:13.255 --> 00:08:14.555
<00:08:13.255>deploy <00:08:13.547>it <00:08:13.840>as <00:08:14.132>a <00:08:14.425>container.

138
00:08:16.055 --> 00:08:18.195
<00:08:16.055>On <00:08:16.255>Friday, <00:08:16.455>you <00:08:16.655>can <00:08:16.855>say, <00:08:17.055>okay, <00:08:17.255>let's, <00:08:17.455>uh,

139
00:08:18.195 --> 00:08:19.235
<00:08:18.195>deploy <00:08:18.429>it <00:08:18.663>as <00:08:18.897>a <00:08:19.131>function.

140
00:08:20.135 --> 00:08:22.835
<00:08:20.135>So <00:08:20.290>like <00:08:20.446>within <00:08:20.601>one <00:08:20.757>week, <00:08:20.912>you <00:08:21.068>have <00:08:21.223>the <00:08:21.379>same <00:08:21.534>functionality,

141
00:08:23.255 --> 00:08:25.675
<00:08:23.255>deploy <00:08:23.430>it <00:08:23.605>as <00:08:23.780>three <00:08:23.955>different <00:08:24.130>types <00:08:24.305>of <00:08:24.480>extract <00:08:24.655>abstraction.

142
00:08:26.495 --> 00:08:29.355
<00:08:26.495>And <00:08:26.622>you <00:08:26.749>imagine <00:08:26.876>the <00:08:27.004>security <00:08:27.131>guys <00:08:27.258>have <00:08:27.385>to <00:08:27.513>take <00:08:27.640>care <00:08:27.767>of <00:08:27.895>this.

143
00:08:30.335 --> 00:08:32.395
<00:08:30.335>So <00:08:30.534>this <00:08:30.734>also <00:08:30.935>leads <00:08:31.135>to <00:08:31.335>a <00:08:31.534>lot <00:08:31.734>more,

144
00:08:32.625 --> 00:08:36.235
<00:08:32.625>more <00:08:32.825>fine <00:08:33.025>grain <00:08:33.225>connections <00:08:33.424>between <00:08:33.625>the <00:08:33.825>different <00:08:34.025>workloads.

145
00:08:36.895 --> 00:08:39.475
<00:08:36.895>And <00:08:37.050>this <00:08:37.206>is <00:08:37.361>really, <00:08:37.517>really <00:08:37.672>becoming <00:08:37.828>an <00:08:37.983>abstraction <00:08:38.139>from <00:08:38.294>the,

146
00:08:39.615 --> 00:08:43.635
<00:08:39.615>uh, <00:08:39.789>sorry, <00:08:39.965>a <00:08:40.140>challenge <00:08:40.315>from <00:08:40.490>the <00:08:40.664>security, <00:08:40.840>uh, <00:08:41.015>standpoint.

147
00:08:47.145 --> 00:08:48.965
<00:08:47.145>And <00:08:47.319>now <00:08:47.495>that <00:08:47.670>this <00:08:47.845>is <00:08:48.020>an <00:08:48.194>actually <00:08:48.370>a <00:08:48.545>challenge.

148
00:08:48.965 --> 00:08:51.125
<00:08:48.965>This <00:08:49.105>is <00:08:49.245>something <00:08:49.385>I <00:08:49.525>like <00:08:49.665>talking <00:08:49.805>about <00:08:49.945>when <00:08:50.085>I, <00:08:50.225>when <00:08:50.365>I,

149
00:08:51.125 --> 00:08:53.965
<00:08:51.125>when <00:08:51.405>we <00:08:51.685>talk <00:08:51.965>about <00:08:52.245>design, <00:08:52.525>uh,

150
00:08:55.525 --> 00:09:00.485
<00:08:55.525>classify <00:08:55.758>your <00:08:55.991>data, <00:08:56.225>uh, <00:08:56.458>I <00:08:56.691>would <00:08:56.925>say,

151
00:09:00.485 --> 00:09:02.085
<00:09:00.485>you <00:09:00.640>know, <00:09:00.796>when <00:09:00.951>you <00:09:01.107>go <00:09:01.262>on <00:09:01.418>holiday, <00:09:01.573>you, <00:09:01.729>you, <00:09:01.885>you,

152
00:09:02.085 --> 00:09:04.005
<00:09:02.085>you're <00:09:02.240>taking, <00:09:02.396>you <00:09:02.551>take <00:09:02.707>your <00:09:02.862>luggage <00:09:03.018>with <00:09:03.173>you, <00:09:03.329>you <00:09:03.485>take,

153
00:09:04.025 --> 00:09:06.485
<00:09:04.025>you, <00:09:04.225>you're <00:09:04.425>taking <00:09:04.625>your <00:09:04.824>travel, <00:09:05.025>travel, <00:09:05.225>uh, <00:09:05.425>uh,

154
00:09:07.665 --> 00:09:08.805
<00:09:07.665>uh, <00:09:07.870>can <00:09:08.075>I <00:09:08.280>say <00:09:08.485>the <00:09:08.690>word?

155
00:09:08.805 --> 00:09:11.325
<00:09:08.805>Sorry, <00:09:08.960>your, <00:09:09.116>your, <00:09:09.271>your, <00:09:09.427>uh, <00:09:09.582>yeah, <00:09:09.738>let's <00:09:09.893>call <00:09:10.049>it <00:09:10.204>luggage.

156
00:09:11.325 --> 00:09:15.085
<00:09:11.325>And <00:09:11.465>you'll <00:09:11.605>put <00:09:11.745>your <00:09:11.885>passport, <00:09:12.025>your <00:09:12.165>money <00:09:12.305>close <00:09:12.445>to <00:09:12.585>your <00:09:12.725>body,

157
00:09:15.995 --> 00:09:18.205
<00:09:15.995>your <00:09:16.228>toothpaste, <00:09:16.461>you'll <00:09:16.695>put <00:09:16.928>into <00:09:17.161>your, <00:09:17.395>uh,

158
00:09:18.435 --> 00:09:19.685
<00:09:18.435>into <00:09:18.810>your <00:09:19.185>overhead <00:09:19.560>luggage

159
00:09:20.465 --> 00:09:22.525
<00:09:20.465>and <00:09:20.665>everything <00:09:20.865>else, <00:09:21.065>which <00:09:21.265>is <00:09:21.465>not <00:09:21.665>really <00:09:21.865>important

160
00:09:22.545 --> 00:09:24.605
<00:09:22.545>to <00:09:22.700>you <00:09:22.856>put <00:09:23.011>into <00:09:23.167>your <00:09:23.322>luggage <00:09:23.478>if <00:09:23.633>it <00:09:23.789>doesn't <00:09:23.944>arrive

161
00:09:24.625 --> 00:09:25.725
<00:09:24.625>the <00:09:24.823>next <00:09:25.021>day <00:09:25.219>at <00:09:25.417>the <00:09:25.615>hotel.

162
00:09:26.585 --> 00:09:28.685
<00:09:26.585>So <00:09:26.935>what, <00:09:27.285>same <00:09:27.635>with <00:09:27.985>data.

163
00:09:29.545 --> 00:09:33.075
<00:09:29.545>It's <00:09:29.719>a <00:09:29.895>lot <00:09:30.069>easier <00:09:30.245>to <00:09:30.420>manage <00:09:30.594>if <00:09:30.770>you <00:09:30.944>take,

164
00:09:33.855 --> 00:09:36.835
<00:09:33.855>pay <00:09:34.055>special <00:09:34.255>attention <00:09:34.455>only <00:09:34.655>to <00:09:34.855>your <00:09:35.055>restricted <00:09:35.255>data,

165
00:09:37.225 --> 00:09:40.195
<00:09:37.225>your <00:09:37.458>private <00:09:37.691>data, <00:09:37.925>anything <00:09:38.158>which <00:09:38.391>is <00:09:38.625>public

166
00:09:41.485 --> 00:09:43.375
<00:09:41.485>doesn't <00:09:41.660>really <00:09:41.835>matter <00:09:42.010>if <00:09:42.185>you <00:09:42.360>get <00:09:42.535>hacked <00:09:42.710>on <00:09:42.885>it.

167
00:09:43.625 --> 00:09:45.615
<00:09:43.625>Maybe <00:09:43.905>it's <00:09:44.185>not <00:09:44.465>a <00:09:44.745>nice <00:09:45.025>publicity,

168
00:09:46.315 --> 00:09:48.655
<00:09:46.315>but <00:09:46.490>you're <00:09:46.665>not <00:09:46.840>losing <00:09:47.015>any <00:09:47.190>personal <00:09:47.365>in, <00:09:47.540>uh, <00:09:47.715>information.

169
00:09:50.435 --> 00:09:52.735
<00:09:50.435>And <00:09:50.590>by <00:09:50.746>the <00:09:50.901>way, <00:09:51.057>I'm <00:09:51.212>not <00:09:51.368>talking <00:09:51.523>about <00:09:51.679>encryption <00:09:51.834>here.

170
00:09:52.775 --> 00:09:53.855
<00:09:52.775>Encryption, <00:09:53.018>of <00:09:53.261>course. <00:09:53.504>I <00:09:53.747>mean,

171
00:09:53.855 --> 00:09:55.255
<00:09:53.855>that's <00:09:54.107>also <00:09:54.359>a <00:09:54.611>very <00:09:54.863>important <00:09:55.115>concept.

172
00:09:55.515 --> 00:09:56.935
<00:09:55.515>But <00:09:55.697>I <00:09:55.880>mean, <00:09:56.062>I <00:09:56.245>think <00:09:56.427>this <00:09:56.610>is <00:09:56.792>given,

173
00:09:57.355 --> 00:09:58.695
<00:09:57.355>so <00:09:57.527>I'm <00:09:57.699>not <00:09:57.871>gonna <00:09:58.044>talk <00:09:58.216>about <00:09:58.388>it <00:09:58.561>here.

174
00:09:59.885 --> 00:10:03.455
<00:09:59.885>Another, <00:10:00.165>uh, <00:10:00.444>aspect <00:10:00.725>to <00:10:01.005>to, <00:10:01.285>to,

175
00:10:03.455 --> 00:10:06.055
<00:10:03.455>to <00:10:03.610>look <00:10:03.766>into <00:10:03.921>when <00:10:04.077>you're <00:10:04.232>designing <00:10:04.388>your <00:10:04.543>data <00:10:04.699>is <00:10:04.855>if

176
00:10:06.055 --> 00:10:07.095
<00:10:06.055>you <00:10:06.367>can <00:10:06.679>do <00:10:06.991>ization.

177
00:10:08.235 --> 00:10:09.535
<00:10:08.235>So, <00:10:08.527>you <00:10:08.819>know, <00:10:09.112>don't, <00:10:09.405>don't,

178
00:10:09.705 --> 00:10:13.375
<00:10:09.705>don't <00:10:09.938>save <00:10:10.171>plain <00:10:10.405>text <00:10:10.638>names, <00:10:10.871>hash <00:10:11.105>them.

179
00:10:14.735 --> 00:10:17.755
<00:10:14.735>So <00:10:14.890>in <00:10:15.046>case <00:10:15.201>you're <00:10:15.357>hacked, <00:10:15.512>if <00:10:15.668>you <00:10:15.823>lose <00:10:15.979>your <00:10:16.135>data,

180
00:10:18.625 --> 00:10:19.635
<00:10:18.625>it's, <00:10:19.079>it's <00:10:19.534>useless.

181
00:10:21.615 --> 00:10:24.635
<00:10:21.615>And <00:10:21.755>a <00:10:21.895>third <00:10:22.035>issue <00:10:22.175>here, <00:10:22.315>I <00:10:22.455>always <00:10:22.595>try <00:10:22.735>to <00:10:22.875>preach <00:10:23.015>is,

182
00:10:24.695 --> 00:10:26.515
<00:10:24.695>uh, <00:10:26.095>anonymization.

183
00:10:27.015 --> 00:10:30.315
<00:10:27.015>So <00:10:27.155>this <00:10:27.295>is <00:10:27.435>a <00:10:27.574>kind <00:10:27.715>of <00:10:27.855>a <00:10:27.995>example <00:10:28.135>I <00:10:28.275>saw <00:10:28.415>recently.

184
00:10:31.295 --> 00:10:34.675
<00:10:31.295>So <00:10:31.402>there <00:10:31.510>was <00:10:31.618>a, <00:10:31.725>there <00:10:31.833>was <00:10:31.941>a, <00:10:32.048>there <00:10:32.156>was <00:10:32.264>a, <00:10:32.371>a <00:10:32.479>method <00:10:32.587>had <00:10:32.694>dates

185
00:10:34.695 --> 00:10:38.955
<00:10:34.695>of <00:10:34.870>birth, <00:10:35.045>and <00:10:35.220>for <00:10:35.395>some <00:10:35.570>reason <00:10:35.745>the <00:10:35.920>developer <00:10:36.095>decided,

186
00:10:39.585 --> 00:10:42.195
<00:10:39.585>okay, <00:10:39.740>the <00:10:39.896>date <00:10:40.051>of <00:10:40.207>birth, <00:10:40.362>and <00:10:40.518>I'll <00:10:40.673>give <00:10:40.829>some <00:10:40.985>extra

187
00:10:43.045 --> 00:10:46.815
<00:10:43.045>context <00:10:43.324>information, <00:10:43.604>name, <00:10:43.885>last <00:10:44.165>name, <00:10:44.444>address.

188
00:10:47.255 --> 00:10:48.375
<00:10:47.255>I <00:10:47.456>didn't <00:10:47.658>put <00:10:47.859>it <00:10:48.061>in <00:10:48.263>here,

189
00:10:49.475 --> 00:10:51.055
<00:10:49.475>but <00:10:49.755>they <00:10:50.035>were <00:10:50.315>using <00:10:50.595>this <00:10:50.875>method

190
00:10:51.115 --> 00:10:53.375
<00:10:51.115>to <00:10:51.348>calculate <00:10:51.581>an <00:10:51.815>average <00:10:52.048>agent, <00:10:52.281>an <00:10:52.515>application.

191
00:10:53.595 --> 00:10:55.415
<00:10:53.595>So, <00:10:53.828>you <00:10:54.061>know, <00:10:54.295>don't, <00:10:54.528>don't <00:10:54.761>worry <00:10:54.995>about

192
00:10:56.285 --> 00:10:57.415
<00:10:56.285>data, <00:10:56.539>which <00:10:56.793>is <00:10:57.047>not <00:10:57.301>needed.

193
00:10:58.795 --> 00:11:00.695
<00:10:58.795>So <00:10:59.028>anonymize <00:10:59.261>as <00:10:59.495>much <00:10:59.728>as <00:10:59.961>you <00:11:00.194>can.

194
00:11:05.245 --> 00:11:09.745
<00:11:05.245>So <00:11:05.595>it's <00:11:05.945>getting <00:11:06.295>more <00:11:06.645>exciting

195
00:11:13.475 --> 00:11:15.175
<00:11:13.475>OP <00:11:13.675>branding <00:11:13.875>in <00:11:14.075>a <00:11:14.275>lot <00:11:14.475>of <00:11:14.675>places <00:11:14.875>today.

196
00:11:15.285 --> 00:11:17.855
<00:11:15.285>Okay? <00:11:15.459>It <00:11:15.635>works <00:11:15.810>in <00:11:15.985>development, <00:11:16.160>it <00:11:16.334>works <00:11:16.510>in <00:11:16.685>staging.

197
00:11:17.945 --> 00:11:19.215
<00:11:17.945>Let's <00:11:18.326>push <00:11:18.707>the <00:11:19.088>production

198
00:11:19.955 --> 00:11:22.495
<00:11:19.955>and <00:11:20.110>let <00:11:20.266>the <00:11:20.421>security <00:11:20.577>guys <00:11:20.732>take <00:11:20.888>care <00:11:21.043>of <00:11:21.199>the <00:11:21.355>rest.

199
00:11:26.485 --> 00:11:27.935
<00:11:26.485>Hardening <00:11:26.920>the <00:11:27.355>DevOps <00:11:27.790>process.

200
00:11:30.405 --> 00:11:32.855
<00:11:30.405>This <00:11:30.560>is <00:11:30.716>what <00:11:30.871>I <00:11:31.027>was <00:11:31.182>talking <00:11:31.338>about, <00:11:31.493>left <00:11:31.649>shifting <00:11:31.805>security.

201
00:11:34.695 --> 00:11:38.155
<00:11:34.695>So <00:11:34.895>basically, <00:11:35.095>the <00:11:35.295>earlier <00:11:35.495>that <00:11:35.695>we <00:11:35.895>can <00:11:36.095>tackle

202
00:11:38.755 --> 00:11:42.165
<00:11:38.755>security <00:11:39.035>related <00:11:39.314>issues <00:11:39.595>in <00:11:39.875>the <00:11:40.155>process,

203
00:11:44.155 --> 00:11:47.855
<00:11:44.155>the <00:11:44.388>easier <00:11:44.621>and <00:11:44.855>the <00:11:45.088>more <00:11:45.321>reliable <00:11:45.555>our

204
00:11:48.485 --> 00:11:49.895
<00:11:48.485>deployments <00:11:49.119>will <00:11:49.754>become.

205
00:11:51.235 --> 00:11:52.615
<00:11:51.235>Uh, <00:11:51.483>this <00:11:51.731>is <00:11:51.980>just <00:11:52.228>an <00:11:52.477>example.

206
00:11:52.775 --> 00:11:55.925
<00:11:52.775>I <00:11:52.902>mean, <00:11:53.029>this <00:11:53.156>is <00:11:53.284>a <00:11:53.411>kind <00:11:53.538>of <00:11:53.665>a <00:11:53.793>stack <00:11:53.920>we've <00:11:54.047>been <00:11:54.175>using.

207
00:11:56.145 --> 00:11:58.365
<00:11:56.145>So, <00:11:56.319>you <00:11:56.495>know, <00:11:56.670>you'll, <00:11:56.845>you'll <00:11:57.020>have <00:11:57.194>your <00:11:57.370>own <00:11:57.545>stack,

208
00:11:58.365 --> 00:12:01.885
<00:11:58.365>you'll <00:11:58.520>have <00:11:58.676>your <00:11:58.831>own <00:11:58.987>tools, <00:11:59.142>you'll <00:11:59.298>have <00:11:59.453>your <00:11:59.609>own <00:11:59.765>security

209
00:12:02.395 --> 00:12:06.525
<00:12:02.395>related, <00:12:02.628>uh, <00:12:02.861>uh, <00:12:03.095>tools <00:12:03.328>you'll <00:12:03.561>be <00:12:03.795>using.

210
00:12:07.625 --> 00:12:09.205
<00:12:07.625>But <00:12:07.858>one <00:12:08.091>thing <00:12:08.325>I'd <00:12:08.558>like <00:12:08.791>to <00:12:09.025>kind

211
00:12:09.205 --> 00:12:12.005
<00:12:09.205>of <00:12:09.438>talk <00:12:09.671>about <00:12:09.905>here <00:12:10.138>is <00:12:10.371>vulnerability <00:12:10.605>management.

212
00:12:13.395 --> 00:12:15.645
<00:12:13.395>When <00:12:13.569>this <00:12:13.745>desi, <00:12:13.920>uh, <00:12:14.095>when <00:12:14.270>this <00:12:14.444>slide <00:12:14.620>was <00:12:14.795>designed,

213
00:12:17.385 --> 00:12:20.145
<00:12:17.385>I <00:12:17.560>would <00:12:17.735>say <00:12:17.910>about, <00:12:18.085>um, <00:12:18.260>a <00:12:18.435>year <00:12:18.610>ago, <00:12:18.785>one

214
00:12:20.145 --> 00:12:24.845
<00:12:20.145>and <00:12:20.319>a <00:12:20.495>half <00:12:20.670>years <00:12:20.845>ago, <00:12:21.020>we <00:12:21.194>have <00:12:21.370>it <00:12:21.545>pretty

215
00:12:24.915 --> 00:12:29.605
<00:12:24.915>late <00:12:25.070>in <00:12:25.226>the, <00:12:25.381>uh, <00:12:25.537>in <00:12:25.692>the, <00:12:25.848>in <00:12:26.003>the <00:12:26.159>DevOps <00:12:26.314>process.

216
00:12:31.885 --> 00:12:34.065
<00:12:31.885>So <00:12:32.040>what <00:12:32.196>I <00:12:32.351>wanna <00:12:32.507>talking <00:12:32.662>about <00:12:32.818>here, <00:12:32.973>I'm <00:12:33.129>talking <00:12:33.285>about,

217
00:12:34.285 --> 00:12:36.425
<00:12:34.285>for <00:12:34.635>example, <00:12:34.985>open <00:12:35.334>source <00:12:35.685>libraries.

218
00:12:36.425 --> 00:12:38.265
<00:12:36.425>You're <00:12:36.658>integrating <00:12:36.891>into <00:12:37.125>your, <00:12:37.358>into <00:12:37.591>your <00:12:37.824>product.

219
00:12:39.385 --> 00:12:42.145
<00:12:39.385>I <00:12:39.560>just <00:12:39.735>delivered, <00:12:39.910>for <00:12:40.085>example, <00:12:40.260>a <00:12:40.435>product <00:12:40.610>about, <00:12:40.785>uh,

220
00:12:42.325 --> 00:12:46.185
<00:12:42.325>two <00:12:42.500>months <00:12:42.675>ago <00:12:42.850>we <00:12:43.025>calculated <00:12:43.200>90% <00:12:43.375>was, <00:12:43.550>uh, <00:12:43.725>was

221
00:12:47.475 --> 00:12:48.845
<00:12:47.475>libraries, <00:12:47.783>which <00:12:48.091>we <00:12:48.399>didn't <00:12:48.708>develop

222
00:12:49.125 --> 00:12:51.565
<00:12:49.125>ourselves, <00:12:49.405>which <00:12:49.685>is <00:12:49.965>quite <00:12:50.245>a <00:12:50.525>bit.

223
00:12:53.505 --> 00:12:54.845
<00:12:53.505>So <00:12:53.706>yeah, <00:12:53.907>these <00:12:54.108>have <00:12:54.309>to <00:12:54.510>be <00:12:54.711>managed.

224
00:12:54.915 --> 00:12:56.605
<00:12:54.915>They <00:12:55.148>have <00:12:55.381>to <00:12:55.615>be <00:12:55.848>managed <00:12:56.081>against <00:12:56.314>vulnerability.

225
00:12:56.785 --> 00:12:58.445
<00:12:56.785>You <00:12:56.985>know, <00:12:57.185>are <00:12:57.385>we <00:12:57.584>using <00:12:57.785>the <00:12:57.985>latest <00:12:58.185>version?

226
00:12:58.545 --> 00:13:01.205
<00:12:58.545>Do <00:12:58.719>we <00:12:58.895>have <00:12:59.069>the <00:12:59.245>same <00:12:59.420>version <00:12:59.594>on <00:12:59.770>in <00:12:59.944>development,

227
00:13:01.985 --> 00:13:04.455
<00:13:01.985>on <00:13:02.451>staging, <00:13:02.918>on <00:13:03.385>production?

228
00:13:05.145 --> 00:13:07.175
<00:13:05.145>There <00:13:05.319>are <00:13:05.495>all <00:13:05.670>kinds <00:13:05.845>of <00:13:06.020>ways <00:13:06.194>of <00:13:06.370>doing <00:13:06.545>this.

229
00:13:08.095 --> 00:13:09.255
<00:13:08.095>I <00:13:08.303>put <00:13:08.512>in <00:13:08.721>a <00:13:08.930>product <00:13:09.139>here,

230
00:13:09.255 --> 00:13:11.735
<00:13:09.255>which <00:13:09.488>I'm <00:13:09.721>pretty <00:13:09.955>excited <00:13:10.188>about, <00:13:10.421>white <00:13:10.655>source.

231
00:13:12.965 --> 00:13:15.615
<00:13:12.965>They, <00:13:13.105>they, <00:13:13.245>they, <00:13:13.385>they, <00:13:13.525>they, <00:13:13.665>they <00:13:13.805>do <00:13:13.945>a <00:13:14.085>pretty <00:13:14.225>good <00:13:14.365>job,

232
00:13:15.675 --> 00:13:17.535
<00:13:15.675>or <00:13:15.802>they, <00:13:15.929>they <00:13:16.056>do <00:13:16.184>a <00:13:16.311>good <00:13:16.438>job, <00:13:16.565>not <00:13:16.693>a <00:13:16.820>pretty <00:13:16.947>good <00:13:17.074>job.

233
00:13:17.695 --> 00:13:21.215
<00:13:17.695>A <00:13:17.835>very <00:13:17.975>good <00:13:18.115>job <00:13:18.255>in <00:13:18.395>assisting <00:13:18.535>you <00:13:18.675>to <00:13:18.815>managing <00:13:18.955>your, <00:13:19.095>your,

234
00:13:21.215 --> 00:13:25.375
<00:13:21.215>your <00:13:21.565>vulnerabilities, <00:13:21.915>understanding <00:13:22.265>which <00:13:22.615>library,

235
00:13:25.505 --> 00:13:28.055
<00:13:25.505>which <00:13:25.738>version, <00:13:25.971>what <00:13:26.205>kind <00:13:26.438>of <00:13:26.671>vulnerabilities <00:13:26.905>exist.

236
00:13:29.235 --> 00:13:32.375
<00:13:29.235>And <00:13:29.435>this <00:13:29.635>could <00:13:29.835>be <00:13:30.035>integrated <00:13:30.235>into <00:13:30.435>your <00:13:30.635>CICD

237
00:13:32.675 --> 00:13:34.455
<00:13:32.675>uh, <00:13:33.375>cycle <00:13:34.074>already.

238
00:13:35.075 --> 00:13:36.535
<00:13:35.075>You <00:13:35.262>can <00:13:35.450>even <00:13:35.638>go <00:13:35.825>back <00:13:36.013>a <00:13:36.201>step <00:13:36.389>further.

239
00:13:36.715 --> 00:13:38.735
<00:13:36.715>You <00:13:36.890>can <00:13:37.065>say, <00:13:37.240>okay, <00:13:37.415>we're <00:13:37.590>gonna <00:13:37.765>be <00:13:37.940>using <00:13:38.115>this

240
00:13:38.735 --> 00:13:42.015
<00:13:38.735>and <00:13:38.910>this <00:13:39.085>version <00:13:39.260>of <00:13:39.435>this <00:13:39.610>and <00:13:39.785>this, <00:13:39.960>uh, <00:13:40.135>tool.

241
00:13:42.435 --> 00:13:45.095
<00:13:42.435>You <00:13:42.609>can, <00:13:42.785>you <00:13:42.959>can <00:13:43.135>catch <00:13:43.310>this <00:13:43.484>with <00:13:43.660>pre-commit <00:13:43.834>hooks.

242
00:13:45.915 --> 00:13:48.735
<00:13:45.915>So <00:13:46.115>if <00:13:46.314>a <00:13:46.515>non <00:13:46.714>vulnerability <00:13:46.915>has <00:13:47.115>become <00:13:47.314>available,

243
00:13:49.755 --> 00:13:53.295
<00:13:49.755>you <00:13:49.895>have <00:13:50.035>your <00:13:50.175>version <00:13:50.314>number <00:13:50.455>in <00:13:50.595>a <00:13:50.735>text <00:13:50.875>file <00:13:51.015>somewhere <00:13:51.155>soon

244
00:13:53.295 --> 00:13:56.575
<00:13:53.295>as <00:13:53.435>you <00:13:53.574>check <00:13:53.714>it <00:13:53.854>in <00:13:53.995>your <00:13:54.135>com <00:13:54.275>pre-commit <00:13:54.415>hook <00:13:54.555>will <00:13:54.694>say

245
00:13:56.575 --> 00:13:57.735
<00:13:56.575>and <00:13:56.783>say, <00:13:56.992>Hey <00:13:57.201>guys, <00:13:57.410>be <00:13:57.619>careful.

246
00:13:57.875 --> 00:13:58.935
<00:13:57.875>Be <00:13:58.113>careful. <00:13:58.352>You've <00:13:58.590>got <00:13:58.829>a,

247
00:13:58.995 --> 00:14:00.655
<00:13:58.995>you've <00:13:59.275>got <00:13:59.555>a <00:13:59.835>potential <00:14:00.115>vulnerability <00:14:00.395>here,

248
00:14:01.515 --> 00:14:02.575
<00:14:01.515>it <00:14:01.753>should <00:14:01.992>be <00:14:02.230>looked <00:14:02.469>at.

249
00:14:04.605 --> 00:14:06.065
<00:14:04.605>So <00:14:04.824>what <00:14:05.043>I'm <00:14:05.262>trying <00:14:05.481>to <00:14:05.700>say <00:14:05.919>is,

250
00:14:06.195 --> 00:14:09.025
<00:14:06.195>don't <00:14:06.428>let <00:14:06.661>these <00:14:06.895>vulnerabilities <00:14:07.128>get <00:14:07.361>into <00:14:07.595>production,

251
00:14:09.025 --> 00:14:12.705
<00:14:09.025>because <00:14:09.225>then <00:14:09.425>it <00:14:09.625>might <00:14:09.824>not <00:14:10.025>be <00:14:10.225>too <00:14:10.425>late,

252
00:14:14.005 --> 00:14:18.665
<00:14:14.005>but <00:14:14.160>the <00:14:14.316>cost, <00:14:14.471>the <00:14:14.627>effort, <00:14:14.782>the <00:14:14.938>time, <00:14:15.093>et <00:14:15.249>cetera, <00:14:15.405>to,

253
00:14:18.805 --> 00:14:23.385
<00:14:18.805>to, <00:14:18.944>to, <00:14:19.084>to <00:14:19.224>fix <00:14:19.364>the <00:14:19.505>situation, <00:14:19.645>again, <00:14:19.785>becomes <00:14:19.925>a <00:14:20.064>lot <00:14:20.204>bigger.

254
00:14:24.805 --> 00:14:27.665
<00:14:24.805>And <00:14:25.005>here, <00:14:25.204>put <00:14:25.405>this <00:14:25.604>in <00:14:25.805>here <00:14:26.005>as <00:14:26.204>well.

255
00:14:27.695 --> 00:14:29.905
<00:14:27.695>This, <00:14:27.835>I <00:14:27.975>mentioned <00:14:28.115>this <00:14:28.255>at <00:14:28.395>the <00:14:28.535>very <00:14:28.675>beginning <00:14:28.815>of <00:14:28.955>my <00:14:29.095>talk.

256
00:14:29.935 --> 00:14:32.025
<00:14:29.935>This <00:14:30.090>is, <00:14:30.246>this <00:14:30.401>is <00:14:30.557>your <00:14:30.712>red <00:14:30.868>team <00:14:31.023>doing, <00:14:31.179>I <00:14:31.334>hope,

257
00:14:32.025 --> 00:14:33.505
<00:14:32.025>continuous <00:14:32.691>penetration <00:14:33.357>testing.

258
00:14:34.535 --> 00:14:36.985
<00:14:34.535>They'll <00:14:34.690>be <00:14:34.846>glad <00:14:35.001>to <00:14:35.157>get <00:14:35.312>input <00:14:35.468>from <00:14:35.623>your <00:14:35.779>abuse <00:14:35.935>cases,

259
00:14:37.335 --> 00:14:38.665
<00:14:37.335>from <00:14:37.933>your <00:14:38.531>known

260
00:14:38.965 --> 00:14:43.505
<00:14:38.965>or <00:14:39.198>your, <00:14:39.431>your <00:14:39.665>envisioned, <00:14:39.898>uh, <00:14:40.131>attack <00:14:40.365>vectors.

261
00:14:45.125 --> 00:14:49.155
<00:14:45.125>So <00:14:45.300>they'll <00:14:45.475>be <00:14:45.650>happy <00:14:45.825>for <00:14:46.000>this <00:14:46.175>kind <00:14:46.350>of <00:14:46.525>information.

262
00:14:49.155 --> 00:14:51.925
<00:14:49.155>It'll <00:14:49.295>make <00:14:49.435>their <00:14:49.574>life <00:14:49.714>a <00:14:49.855>lot <00:14:49.995>easier <00:14:50.135>instead <00:14:50.275>of <00:14:50.415>getting <00:14:50.555>hacked

263
00:14:51.925 --> 00:14:54.805
<00:14:51.925>and <00:14:52.158>then <00:14:52.391>putting <00:14:52.625>this <00:14:52.858>kind <00:14:53.091>of, <00:14:53.324>uh,

264
00:14:55.905 --> 00:14:57.795
<00:14:55.905>knowledge <00:14:56.371>into <00:14:56.838>their <00:14:57.305>process.

265
00:14:58.095 --> 00:14:59.355
<00:14:58.095>And <00:14:58.321>again, <00:14:58.548>this <00:14:58.775>should <00:14:59.002>be <00:14:59.229>called

266
00:14:59.885 --> 00:15:01.435
<00:14:59.885>continuous <00:15:00.582>penetration <00:15:01.280>testing

267
00:15:02.575 --> 00:15:05.115
<00:15:02.575>and <00:15:02.808>not <00:15:03.041>just, <00:15:03.275>uh, <00:15:03.508>punctual <00:15:03.741>penetration <00:15:03.975>testing,

268
00:15:05.205 --> 00:15:06.995
<00:15:05.205>which <00:15:05.671>you <00:15:06.138>usually <00:15:06.605>see.

269
00:15:07.055 --> 00:15:09.475
<00:15:07.055>So <00:15:07.229>a <00:15:07.405>company <00:15:07.579>will <00:15:07.755>say, <00:15:07.930>come <00:15:08.104>on, <00:15:08.280>come <00:15:08.454>guys,

270
00:15:09.475 --> 00:15:12.595
<00:15:09.475>let's <00:15:09.650>do <00:15:09.825>a <00:15:10.000>pen <00:15:10.175>test, <00:15:10.350>and <00:15:10.525>then <00:15:10.700>everything's <00:15:10.875>okay,

271
00:15:12.735 --> 00:15:14.595
<00:15:12.735>and <00:15:12.910>then <00:15:13.085>they <00:15:13.260>won't <00:15:13.435>do <00:15:13.610>it <00:15:13.785>for <00:15:13.960>another <00:15:14.135>year.

272
00:15:15.335 --> 00:15:20.035
<00:15:15.335>And <00:15:15.462>so <00:15:15.589>much <00:15:15.716>changes <00:15:15.844>in <00:15:15.971>that <00:15:16.098>even <00:15:16.225>short <00:15:16.353>period <00:15:16.480>of <00:15:16.607>time, <00:15:16.735>uh,

273
00:15:20.105 --> 00:15:23.235
<00:15:20.105>with <00:15:20.260>depending <00:15:20.416>on, <00:15:20.571>yeah, <00:15:20.727>what <00:15:20.882>kind <00:15:21.038>of <00:15:21.193>results <00:15:21.349>you <00:15:21.505>get.

274
00:15:25.515 --> 00:15:28.095
<00:15:25.515>And, <00:15:25.689>uh, <00:15:25.865>I <00:15:26.040>just <00:15:26.215>put <00:15:26.390>these <00:15:26.564>stats <00:15:26.740>in <00:15:26.915>here

275
00:15:28.515 --> 00:15:29.735
<00:15:28.515>to <00:15:28.789>prove <00:15:29.064>something <00:15:29.338>or <00:15:29.613>nothing.

276
00:15:30.195 --> 00:15:31.535
<00:15:30.195>But, <00:15:30.496>uh, <00:15:30.798>it's <00:15:31.099>a <00:15:31.401>kind

277
00:15:31.535 --> 00:15:33.655
<00:15:31.535>of <00:15:31.735>experience <00:15:31.935>I'm <00:15:32.135>also <00:15:32.334>having <00:15:32.535>in <00:15:32.735>my <00:15:32.935>work.

278
00:15:35.435 --> 00:15:38.125
<00:15:35.435>Uh, <00:15:35.714>the <00:15:35.994>more <00:15:36.275>security <00:15:36.555>you <00:15:36.834>apply

279
00:15:38.125 --> 00:15:39.525
<00:15:38.125>through <00:15:38.545>your <00:15:38.965>development <00:15:39.385>lifecycle,

280
00:15:39.865 --> 00:15:41.805
<00:15:39.865>the <00:15:40.065>more <00:15:40.265>time <00:15:40.465>you <00:15:40.665>spend <00:15:40.865>on <00:15:41.065>interesting <00:15:41.265>work.

281
00:15:43.205 --> 00:15:47.885
<00:15:43.205>I <00:15:43.345>will <00:15:43.485>kind <00:15:43.625>of <00:15:43.765>almost <00:15:43.905>say, <00:15:44.045>uh, <00:15:44.185>I <00:15:44.325>wasted <00:15:44.465>a <00:15:44.605>year

282
00:15:47.885 --> 00:15:51.925
<00:15:47.885>of <00:15:48.165>my <00:15:48.444>life, <00:15:48.725>uh, <00:15:49.005>fixing <00:15:49.285>security

283
00:15:52.925 --> 00:15:55.645
<00:15:52.925>breaches <00:15:53.275>or <00:15:53.625>security <00:15:53.974>related <00:15:54.324>breaches,

284
00:15:56.695 --> 00:16:00.125
<00:15:56.695>which <00:15:57.161>most <00:15:57.628>probably <00:15:58.095>if

285
00:16:00.635 --> 00:16:04.925
<00:16:00.635>developed <00:16:00.835>correctly, <00:16:01.035>developed <00:16:01.235>with <00:16:01.435>only <00:16:01.635>a <00:16:01.835>small <00:16:02.035>kind

286
00:16:05.085 --> 00:16:08.205
<00:16:05.085>of <00:16:05.285>feeling <00:16:05.485>for, <00:16:05.685>for, <00:16:05.885>for, <00:16:06.085>uh, <00:16:06.285>for <00:16:06.485>security,

287
00:16:09.015 --> 00:16:10.125
<00:16:09.015>could <00:16:09.348>have <00:16:09.681>been <00:16:10.014>avoided.

288
00:16:12.465 --> 00:16:16.525
<00:16:12.465>So, <00:16:12.620>just <00:16:12.776>kind <00:16:12.931>of <00:16:13.087>afterthought <00:16:13.242>on <00:16:13.398>this, <00:16:13.553>on <00:16:13.709>this <00:16:13.865>issue.

289
00:16:17.745 --> 00:16:19.245
<00:16:17.745>Now <00:16:17.970>let's <00:16:18.195>get <00:16:18.420>to <00:16:18.645>the <00:16:18.870>exciting <00:16:19.095>stuff.

290
00:16:19.565 --> 00:16:20.645
<00:16:19.565>Actually, <00:16:19.703>what <00:16:19.842>I <00:16:19.981>wanted <00:16:20.120>to <00:16:20.259>talk <00:16:20.398>about <00:16:20.537>today.

291
00:16:21.065 --> 00:16:24.605
<00:16:21.065>So <00:16:21.192>you <00:16:21.319>can't <00:16:21.446>see, <00:16:21.574>or <00:16:21.701>you <00:16:21.828>can't <00:16:21.955>hack <00:16:22.083>what <00:16:22.210>you <00:16:22.337>can't <00:16:22.465>see.

292
00:16:27.455 --> 00:16:30.315
<00:16:27.455>So <00:16:27.630>we've <00:16:27.805>given <00:16:27.980>it <00:16:28.155>over <00:16:28.330>to <00:16:28.505>our <00:16:28.680>security <00:16:28.855>department.

293
00:16:30.315 --> 00:16:33.435
<00:16:30.315>What <00:16:30.515>happens <00:16:30.715>next? <00:16:30.915>First <00:16:31.115>of <00:16:31.315>all, <00:16:31.515>I'd <00:16:31.715>like

294
00:16:33.435 --> 00:16:35.355
<00:16:33.435>to <00:16:33.714>talk <00:16:33.994>about <00:16:34.275>east <00:16:34.555>west <00:16:34.834>traffic.

295
00:16:35.655 --> 00:16:38.075
<00:16:35.655>So <00:16:35.829>not <00:16:36.005>about <00:16:36.180>Interstate <00:16:36.355>80, <00:16:36.530>which <00:16:36.704>goes <00:16:36.880>east, <00:16:37.055>west

296
00:16:38.075 --> 00:16:41.275
<00:16:38.075>through <00:16:38.230>the <00:16:38.386>United <00:16:38.541>States, <00:16:38.697>but <00:16:38.852>what <00:16:39.008>is <00:16:39.163>east <00:16:39.319>west <00:16:39.475>traffic?

297
00:16:45.045 --> 00:16:49.455
<00:16:45.045>Uh, <00:16:45.324>this <00:16:45.604>is <00:16:45.885>the <00:16:46.165>main <00:16:46.444>entrance

298
00:16:49.455 --> 00:16:51.815
<00:16:49.455>where <00:16:49.688>you <00:16:49.921>see <00:16:50.155>20%, <00:16:50.388>20%, <00:16:50.621>that's <00:16:50.855>the,

299
00:16:51.815 --> 00:16:53.295
<00:16:51.815>that's <00:16:52.037>the <00:16:52.259>main <00:16:52.481>entrance <00:16:52.703>to <00:16:52.925>this <00:16:53.146>office.

300
00:16:53.835 --> 00:16:58.775
<00:16:53.835>That's <00:16:54.068>where <00:16:54.301>most, <00:16:54.535>uh, <00:16:54.768>visitors <00:16:55.001>should, <00:16:55.235>uh,

301
00:16:58.775 --> 00:17:01.775
<00:16:58.775>should, <00:16:58.975>should, <00:16:59.175>should <00:16:59.375>get <00:16:59.574>to, <00:16:59.775>should, <00:16:59.975>should <00:17:00.175>walk

302
00:17:01.775 --> 00:17:02.895
<00:17:01.775>through <00:17:01.976>to <00:17:02.178>get <00:17:02.379>into <00:17:02.581>the <00:17:02.783>office.

303
00:17:04.735 --> 00:17:08.755
<00:17:04.734>But <00:17:05.014>in <00:17:05.294>today's <00:17:05.574>workload <00:17:05.854>cloud <00:17:06.135>environment,

304
00:17:11.215 --> 00:17:13.315
<00:17:11.214>we <00:17:11.448>stay <00:17:11.681>about <00:17:11.915>80% <00:17:12.148>of <00:17:12.381>all <00:17:12.615>traffic,

305
00:17:13.375 --> 00:17:16.235
<00:17:13.375>of <00:17:13.608>all <00:17:13.841>communication <00:17:14.075>happens <00:17:14.308>within <00:17:14.541>the <00:17:14.775>office.

306
00:17:16.975 --> 00:17:21.095
<00:17:16.974>So <00:17:17.175>these <00:17:17.375>are <00:17:17.574>kind <00:17:17.774>of <00:17:17.974>communication <00:17:18.175>between <00:17:18.375>people

307
00:17:21.195 --> 00:17:25.255
<00:17:21.194>who <00:17:21.335>are <00:17:21.474>legal <00:17:21.615>in <00:17:21.754>the <00:17:21.895>office, <00:17:22.034>maybe <00:17:22.175>people <00:17:22.314>who <00:17:22.454>came <00:17:22.595>in

308
00:17:25.255 --> 00:17:29.215
<00:17:25.255>through <00:17:25.395>a <00:17:25.535>side <00:17:25.675>door <00:17:25.815>through <00:17:25.955>a, <00:17:26.095>through <00:17:26.235>an <00:17:26.375>open <00:17:26.515>window, <00:17:26.655>uh,

309
00:17:29.215 --> 00:17:30.655
<00:17:29.215>totally <00:17:29.539>legal <00:17:29.862>in <00:17:30.187>the <00:17:30.511>office.

310
00:17:31.995 --> 00:17:36.345
<00:17:31.995>And <00:17:32.169>this <00:17:32.344>is <00:17:32.520>what <00:17:32.695>the, <00:17:32.870>the <00:17:33.044>area <00:17:33.219>we're <00:17:33.395>trying

311
00:17:36.345 --> 00:17:38.425
<00:17:36.345>to <00:17:36.472>protect <00:17:36.599>today, <00:17:36.726>or <00:17:36.854>the <00:17:36.981>area <00:17:37.108>we <00:17:37.235>have <00:17:37.363>to <00:17:37.490>focus <00:17:37.617>on <00:17:37.745>more.

312
00:17:39.365 --> 00:17:44.045
<00:17:39.365>So <00:17:39.565>it's <00:17:39.765>no <00:17:39.965>longer <00:17:40.165>just <00:17:40.365>firewalling <00:17:40.565>your <00:17:40.765>segments

313
00:17:44.105 --> 00:17:46.605
<00:17:44.105>or <00:17:44.280>segmenting <00:17:44.455>and <00:17:44.630>then <00:17:44.805>putting <00:17:44.980>a <00:17:45.155>firewall <00:17:45.330>in <00:17:45.505>front

314
00:17:46.605 --> 00:17:49.045
<00:17:46.605>of <00:17:46.955>each <00:17:47.305>segment, <00:17:47.655>uh, <00:17:48.005>maybe

315
00:17:49.085 --> 00:17:52.245
<00:17:49.085>with <00:17:49.225>a <00:17:49.365>web <00:17:49.505>application <00:17:49.645>firewall <00:17:49.785>in <00:17:49.925>there <00:17:50.065>as <00:17:50.205>well, <00:17:50.345>just <00:17:50.485>for,

316
00:17:52.305 --> 00:17:53.365
<00:17:52.305>for, <00:17:52.623>for <00:17:52.941>good <00:17:53.259>measures.

317
00:17:54.105 --> 00:17:57.405
<00:17:54.105>But <00:17:54.455>how <00:17:54.805>can <00:17:55.155>I <00:17:55.505>protect

318
00:17:58.145 --> 00:17:59.685
<00:17:58.145>the <00:17:58.491>so-called <00:17:58.838>east <00:17:59.184>west <00:17:59.531>traffic?

319
00:18:06.725 --> 00:18:09.885
<00:18:06.725>So <00:18:07.004>it's <00:18:07.284>also <00:18:07.564>interesting <00:18:07.844>fact <00:18:08.125>that

320
00:18:14.575 --> 00:18:19.495
<00:18:14.575>probably <00:18:14.715>you <00:18:14.855>can <00:18:14.995>almost <00:18:15.135>say <00:18:15.275>today <00:18:15.415>that <00:18:15.555>you <00:18:15.695>will <00:18:15.835>not <00:18:15.975>get

321
00:18:20.055 --> 00:18:24.615
<00:18:20.055>attacked <00:18:20.230>on <00:18:20.405>level <00:18:20.580>one <00:18:20.755>to <00:18:20.930>three <00:18:21.105>in <00:18:21.280>your <00:18:21.455>application.

322
00:18:24.635 --> 00:18:27.255
<00:18:24.635>So <00:18:24.810>basically <00:18:24.985>what <00:18:25.160>most <00:18:25.335>firewalls <00:18:25.510>are <00:18:25.685>protecting <00:18:25.860>you <00:18:26.035>against

323
00:18:27.805 --> 00:18:29.775
<00:18:27.805>attacks <00:18:28.038>today <00:18:28.271>happen <00:18:28.505>at <00:18:28.738>a <00:18:28.971>higher <00:18:29.205>level.

324
00:18:29.775 --> 00:18:31.295
<00:18:29.775>They <00:18:30.117>happen <00:18:30.459>at <00:18:30.801>application <00:18:31.143>level,

325
00:18:32.005 --> 00:18:33.855
<00:18:32.005>they <00:18:32.355>happen <00:18:32.705>at <00:18:33.055>user <00:18:33.405>levels.

326
00:18:34.015 --> 00:18:38.215
<00:18:34.015>I <00:18:34.215>mean, <00:18:34.415>85% <00:18:34.615>of <00:18:34.815>all <00:18:35.015>successful <00:18:35.215>penetrations <00:18:35.415>are

327
00:18:38.405 --> 00:18:41.935
<00:18:38.405>because <00:18:38.685>of, <00:18:38.965>uh, <00:18:39.245>human, <00:18:39.524>human <00:18:39.805>error.

328
00:18:43.275 --> 00:18:45.415
<00:18:43.275>So, <00:18:43.450>like <00:18:43.625>I <00:18:43.800>said, <00:18:43.975>it <00:18:44.150>really, <00:18:44.325>we <00:18:44.500>really <00:18:44.675>have

329
00:18:45.415 --> 00:18:47.655
<00:18:45.415>to <00:18:45.590>start <00:18:45.764>focusing <00:18:45.940>on <00:18:46.115>this, <00:18:46.290>this, <00:18:46.465>this <00:18:46.639>traffic <00:18:46.815>here.

330
00:18:47.715 --> 00:18:50.295
<00:18:47.715>How <00:18:47.915>can <00:18:48.115>we <00:18:48.314>protect <00:18:48.514>ourselves <00:18:48.715>against <00:18:48.915>malicious <00:18:49.115>traffic

331
00:18:51.445 --> 00:18:52.745
<00:18:51.445>behind <00:18:52.030>our <00:18:52.614>firewalls?

332
00:18:57.615 --> 00:18:59.035
<00:18:57.615>So <00:18:57.934>what <00:18:58.254>are <00:18:58.573>the <00:18:58.893>steps?

333
00:19:01.505 --> 00:19:04.105
<00:19:01.505>Security <00:19:01.660>must <00:19:01.816>move <00:19:01.971>closer <00:19:02.127>to <00:19:02.282>the <00:19:02.438>data's <00:19:02.593>trying <00:19:02.749>to <00:19:02.905>protect.

334
00:19:04.285 --> 00:19:07.995
<00:19:04.285>So <00:19:04.518>we <00:19:04.751>must <00:19:04.985>start <00:19:05.218>securing <00:19:05.451>our <00:19:05.685>workloads.

335
00:19:08.625 --> 00:19:12.235
<00:19:08.625>It's <00:19:08.825>no <00:19:09.025>longer <00:19:09.225>enough <00:19:09.425>to <00:19:09.625>firewall <00:19:09.825>several <00:19:10.025>workloads.

336
00:19:13.495 --> 00:19:15.275
<00:19:13.495>Uh, <00:19:13.695>just <00:19:13.895>let <00:19:14.094>them <00:19:14.294>talk <00:19:14.495>to <00:19:14.695>each <00:19:14.895>other

337
00:19:15.615 --> 00:19:17.515
<00:19:15.615>as <00:19:15.848>if <00:19:16.081>there's <00:19:16.315>never <00:19:16.548>been <00:19:16.781>a <00:19:17.015>problem.

338
00:19:18.535 --> 00:19:22.795
<00:19:18.535>We <00:19:18.768>must <00:19:19.001>start <00:19:19.235>protecting, <00:19:19.468>uh, <00:19:19.701>workloads <00:19:19.935>individually.

339
00:19:24.765 --> 00:19:28.105
<00:19:24.765>Uh, <00:19:24.965>security <00:19:25.165>must <00:19:25.365>become <00:19:25.565>part <00:19:25.765>of <00:19:25.965>our <00:19:26.165>design.

340
00:19:28.405 --> 00:19:30.145
<00:19:28.405>That's <00:19:28.605>why <00:19:28.805>I <00:19:29.004>was <00:19:29.205>also <00:19:29.405>saying <00:19:29.605>an <00:19:29.805>issue.

341
00:19:30.145 --> 00:19:31.505
<00:19:30.145>You <00:19:30.389>know, <00:19:30.634>think <00:19:30.879>about <00:19:31.124>abuse <00:19:31.369>cases.

342
00:19:32.005 --> 00:19:33.465
<00:19:32.005>If <00:19:32.267>you <00:19:32.530>understand <00:19:32.793>your <00:19:33.056>abuse <00:19:33.319>cases,

343
00:19:33.565 --> 00:19:36.545
<00:19:33.565>you <00:19:33.845>will <00:19:34.125>start <00:19:34.405>designing <00:19:34.685>security <00:19:34.965>today.

344
00:19:36.545 --> 00:19:39.025
<00:19:36.545>It's <00:19:36.700>mostly <00:19:36.856>still <00:19:37.011>a <00:19:37.167>remedial <00:19:37.322>measure, <00:19:37.478>you <00:19:37.633>know, <00:19:37.789>okay, <00:19:37.945>we,

345
00:19:39.405 --> 00:19:41.665
<00:19:39.405>it, <00:19:39.754>it <00:19:40.105>compiles, <00:19:40.455>let's <00:19:40.805>deploy,

346
00:19:42.405 --> 00:19:44.625
<00:19:42.405>and <00:19:42.580>someone <00:19:42.754>will <00:19:42.930>figure <00:19:43.105>out <00:19:43.280>how <00:19:43.455>to <00:19:43.629>protect <00:19:43.805>it.

347
00:19:46.285 --> 00:19:50.505
<00:19:46.285>And <00:19:46.425>last <00:19:46.565>but <00:19:46.705>not <00:19:46.845>least, <00:19:46.985>security <00:19:47.125>can <00:19:47.265>no <00:19:47.405>longer <00:19:47.545>be, <00:19:47.685>uh,

348
00:19:50.575 --> 00:19:52.025
<00:19:50.575>coupled <00:19:51.010>with <00:19:51.445>the <00:19:51.880>infrastructure.

349
00:19:53.285 --> 00:19:57.785
<00:19:53.285>So <00:19:53.440>it <00:19:53.596>shouldn't <00:19:53.751>be <00:19:53.907>handled <00:19:54.062>at <00:19:54.218>network <00:19:54.373>level, <00:19:54.529>at, <00:19:54.685>uh,

350
00:19:58.215 --> 00:20:00.785
<00:19:58.215>data <00:19:58.370>center <00:19:58.526>level <00:19:58.681>if <00:19:58.837>you're <00:19:58.992>still <00:19:59.148>working <00:19:59.303>with <00:19:59.459>data <00:19:59.615>centers.

351
00:20:01.765 --> 00:20:04.265
<00:20:01.765>But <00:20:01.965>these <00:20:02.165>policies <00:20:02.365>must <00:20:02.565>move <00:20:02.765>up <00:20:02.965>several <00:20:03.165>levels.

352
00:20:04.405 --> 00:20:07.625
<00:20:04.405>And <00:20:04.605>like <00:20:04.805>I <00:20:05.004>said <00:20:05.205>before, <00:20:05.405>initially <00:20:05.605>start <00:20:05.805>protecting

353
00:20:07.625 --> 00:20:08.985
<00:20:07.625>your <00:20:08.236>workloads <00:20:08.849>individually.

354
00:20:12.675 --> 00:20:14.965
<00:20:12.675>Uh, <00:20:12.908>so <00:20:13.141>what <00:20:13.375>do <00:20:13.608>we <00:20:13.841>get <00:20:14.075>doing?

355
00:20:15.065 --> 00:20:17.125
<00:20:15.065>So <00:20:15.172>what <00:20:15.280>do <00:20:15.388>we <00:20:15.495>get <00:20:15.603>if <00:20:15.711>we <00:20:15.818>go, <00:20:15.926>if <00:20:16.034>we <00:20:16.141>go <00:20:16.249>down <00:20:16.357>this <00:20:16.465>path,

356
00:20:20.185 --> 00:20:22.725
<00:20:20.185>you <00:20:20.385>immensely <00:20:20.585>reduce <00:20:20.784>the <00:20:20.985>attack <00:20:21.185>surface <00:20:21.385>per <00:20:21.585>workload.

357
00:20:23.025 --> 00:20:26.365
<00:20:23.025>So <00:20:23.180>you <00:20:23.336>have <00:20:23.491>to <00:20:23.647>imagine <00:20:23.802>like <00:20:23.958>a <00:20:24.113>firewall <00:20:24.269>per <00:20:24.425>workload.

358
00:20:26.705 --> 00:20:28.365
<00:20:26.705>Of <00:20:26.938>course, <00:20:27.171>it's <00:20:27.405>not <00:20:27.638>a <00:20:27.871>physical <00:20:28.105>firewall,

359
00:20:29.025 --> 00:20:32.725
<00:20:29.025>but <00:20:29.165>it's <00:20:29.305>a <00:20:29.445>logical <00:20:29.585>firewall <00:20:29.725>put <00:20:29.865>in <00:20:30.005>front <00:20:30.145>of <00:20:30.285>each <00:20:30.425>workload,

360
00:20:33.525 --> 00:20:37.685
<00:20:33.525>defining <00:20:33.758>which <00:20:33.991>other <00:20:34.225>workloads, <00:20:34.458>which <00:20:34.691>other <00:20:34.925>processes,

361
00:20:38.155 --> 00:20:41.645
<00:20:38.155>processes, <00:20:38.388>processes <00:20:38.621>are <00:20:38.855>allowed <00:20:39.088>to <00:20:39.321>communicate <00:20:39.555>with

362
00:20:41.645 --> 00:20:42.725
<00:20:41.645>that <00:20:42.130>specific <00:20:42.617>workload.

363
00:20:44.515 --> 00:20:47.560
<00:20:44.515>This, <00:20:44.715>again, <00:20:44.915>coming <00:20:45.115>back <00:20:45.315>to <00:20:45.515>east <00:20:45.715>west <00:20:45.915>traffic

364
00:20:48.375 --> 00:20:50.115
<00:20:48.375>limits <00:20:48.841>the <00:20:49.308>radius <00:20:49.775>through,

365
00:20:50.335 --> 00:20:53.035
<00:20:50.335>or <00:20:50.535>basically <00:20:50.735>we're <00:20:50.935>doing <00:20:51.135>what <00:20:51.335>we <00:20:51.535>call <00:20:51.735>microsegmentation.

366
00:20:54.335 --> 00:20:57.275
<00:20:54.335>So <00:20:54.490>a <00:20:54.646>seg <00:20:54.801>a <00:20:54.957>segment <00:20:55.112>could <00:20:55.268>be <00:20:55.423>a <00:20:55.579>single <00:20:55.735>workload,

367
00:20:57.435 --> 00:20:59.875
<00:20:57.435>a <00:20:57.590>segment <00:20:57.746>could <00:20:57.901>be <00:20:58.057>two <00:20:58.212>workloads <00:20:58.368>who <00:20:58.523>are <00:20:58.679>allowed <00:20:58.835>to

368
00:21:00.475 --> 00:21:04.995
<00:21:00.475>communicate <00:21:00.649>with <00:21:00.824>each <00:21:01.000>other, <00:21:01.175>uh, <00:21:01.350>using <00:21:01.524>the <00:21:01.699>right <00:21:01.875>tools,

369
00:21:05.055 --> 00:21:06.075
<00:21:05.055>we <00:21:05.361>will <00:21:05.667>have <00:21:05.973>visibility,

370
00:21:07.155 --> 00:21:09.525
<00:21:07.155>meaning <00:21:07.330>we're <00:21:07.504>not <00:21:07.680>talking <00:21:07.855>level <00:21:08.030>one <00:21:08.205>to <00:21:08.379>three <00:21:08.555>anymore.

371
00:21:09.575 --> 00:21:11.805
<00:21:09.575>We're <00:21:09.775>talking <00:21:09.975>level <00:21:10.175>seven, <00:21:10.375>level <00:21:10.575>one <00:21:10.775>to <00:21:10.975>seven.

372
00:21:12.505 --> 00:21:16.125
<00:21:12.505>So <00:21:12.738>we'll <00:21:12.971>see <00:21:13.205>anomalies <00:21:13.438>at <00:21:13.671>application <00:21:13.905>level.

373
00:21:19.955 --> 00:21:22.695
<00:21:19.955>And <00:21:20.095>here <00:21:20.235>come, <00:21:20.375>this <00:21:20.514>is <00:21:20.655>where <00:21:20.794>the <00:21:20.935>challenge <00:21:21.074>has <00:21:21.215>now <00:21:21.355>come,

374
00:21:22.695 --> 00:21:24.695
<00:21:22.695>you <00:21:22.870>know, <00:21:23.044>how <00:21:23.220>can, <00:21:23.395>how <00:21:23.570>can <00:21:23.745>we <00:21:23.919>orchestrate <00:21:24.095>this?

375
00:21:24.995 --> 00:21:27.055
<00:21:24.995>How <00:21:25.169>can <00:21:25.344>we <00:21:25.520>automate <00:21:25.695>this? <00:21:25.870>This <00:21:26.044>is <00:21:26.219>not <00:21:26.395>easy.

376
00:21:27.445 --> 00:21:28.535
<00:21:27.445>It's <00:21:27.935>absolutely <00:21:28.426>clear.

377
00:21:29.045 --> 00:21:31.575
<00:21:29.045>This <00:21:29.220>is <00:21:29.395>not <00:21:29.570>something <00:21:29.745>which, <00:21:29.920>uh, <00:21:30.095>usually <00:21:30.270>gets <00:21:30.445>done

378
00:21:31.575 --> 00:21:32.895
<00:21:31.575>or <00:21:31.744>can <00:21:31.914>be <00:21:32.084>done <00:21:32.253>out <00:21:32.423>of <00:21:32.593>the <00:21:32.763>box.

379
00:21:34.075 --> 00:21:37.415
<00:21:34.075>But <00:21:34.250>the <00:21:34.425>idea <00:21:34.600>would <00:21:34.775>be, <00:21:34.950>in <00:21:35.125>the <00:21:35.300>ideal <00:21:35.475>world,

380
00:21:38.155 --> 00:21:42.985
<00:21:38.155>in <00:21:38.355>an <00:21:38.555>ideal <00:21:38.754>environment, <00:21:38.955>we <00:21:39.155>have <00:21:39.355>a <00:21:39.555>tool,

381
00:21:44.565 --> 00:21:46.625
<00:21:44.565>um, <00:21:45.265>data <00:21:45.965>lake

382
00:21:46.625 --> 00:21:50.185
<00:21:46.625>or <00:21:46.752>whatever <00:21:46.879>you <00:21:47.006>want <00:21:47.134>to <00:21:47.261>call <00:21:47.388>it, <00:21:47.515>which <00:21:47.643>allows <00:21:47.770>us <00:21:47.897>to, <00:21:48.025>to,

383
00:21:50.285 --> 00:21:53.225
<00:21:50.285>to <00:21:50.635>orchestrate <00:21:50.985>and <00:21:51.335>automate <00:21:51.685>this

384
00:21:54.975 --> 00:21:56.215
<00:21:54.975>firewall <00:21:55.347>per <00:21:55.718>workload <00:21:56.091>concept.

385
00:22:01.065 --> 00:22:03.915
<00:22:01.065>So <00:22:01.345>what <00:22:01.625>does <00:22:01.905>this <00:22:02.185>bring <00:22:02.465>us?

386
00:22:09.335 --> 00:22:13.325
<00:22:09.335>It <00:22:09.510>means <00:22:09.685>we <00:22:09.860>as <00:22:10.035>developers <00:22:10.210>have <00:22:10.385>to <00:22:10.560>start <00:22:10.735>defining

387
00:22:14.535 --> 00:22:15.845
<00:22:14.535>intentions <00:22:15.124>for <00:22:15.714>workload.

388
00:22:15.945 --> 00:22:18.405
<00:22:15.945>So <00:22:16.225>we're <00:22:16.504>going <00:22:16.784>basically <00:22:17.064>into <00:22:17.345>whitelisting.

389
00:22:18.405 --> 00:22:21.815
<00:22:18.405>We're <00:22:18.580>no <00:22:18.754>longer <00:22:18.930>blacklisting. <00:22:19.105>Who <00:22:19.280>are <00:22:19.455>the <00:22:19.629>bad <00:22:19.805>guys?

390
00:22:21.835 --> 00:22:22.895
<00:22:21.835>Who <00:22:22.073>shouldn't <00:22:22.312>talk <00:22:22.550>to <00:22:22.789>us?

391
00:22:22.895 --> 00:22:24.895
<00:22:22.895>We <00:22:23.070>want <00:22:23.245>to <00:22:23.420>know <00:22:23.595>who <00:22:23.770>should <00:22:23.945>talk <00:22:24.120>to <00:22:24.295>us,

392
00:22:25.465 --> 00:22:29.855
<00:22:25.465>which <00:22:25.605>other <00:22:25.745>workloads <00:22:25.885>are <00:22:26.024>allowed <00:22:26.165>to <00:22:26.304>ask <00:22:26.445>us <00:22:26.584>for <00:22:26.725>a <00:22:26.865>request?

393
00:22:29.995 --> 00:22:33.015
<00:22:29.995>Ask <00:22:30.169>us <00:22:30.344>for <00:22:30.520>data, <00:22:30.695>which <00:22:30.870>then <00:22:31.044>goes <00:22:31.219>into <00:22:31.395>the

394
00:22:33.145 --> 00:22:34.335
<00:22:33.145>realm <00:22:33.502>of <00:22:33.859>zero <00:22:34.216>trust.

395
00:22:35.475 --> 00:22:36.975
<00:22:35.475>So, <00:22:35.699>you <00:22:35.925>know, <00:22:36.149>don't <00:22:36.375>let <00:22:36.600>everybody <00:22:36.824>talk

396
00:22:36.975 --> 00:22:38.695
<00:22:36.975>to <00:22:37.149>us <00:22:37.324>except <00:22:37.500>the <00:22:37.675>few <00:22:37.850>bad <00:22:38.024>guys <00:22:38.199>we <00:22:38.375>know.

397
00:22:39.445 --> 00:22:42.065
<00:22:39.445>But, <00:22:39.600>uh, <00:22:39.756>we <00:22:39.911>just <00:22:40.067>want <00:22:40.222>to <00:22:40.378>talk <00:22:40.533>to <00:22:40.689>the <00:22:40.845>couple

398
00:22:42.065 --> 00:22:43.505
<00:22:42.065>of <00:22:42.281>guys <00:22:42.497>we <00:22:42.713>know <00:22:42.929>who <00:22:43.145>are <00:22:43.361>good.

399
00:22:44.945 --> 00:22:47.885
<00:22:44.945>And <00:22:45.061>it's <00:22:45.178>like <00:22:45.294>if <00:22:45.411>you <00:22:45.528>have <00:22:45.645>a <00:22:45.761>$100,000 <00:22:45.878>you <00:22:45.995>want <00:22:46.111>to, <00:22:46.228>you <00:22:46.345>have,

400
00:22:47.885 --> 00:22:50.085
<00:22:47.885>you <00:22:48.085>have <00:22:48.285>him <00:22:48.485>in <00:22:48.685>a <00:22:48.885>suitcase, <00:22:49.085>you <00:22:49.285>need

401
00:22:50.085 --> 00:22:51.245
<00:22:50.085>to <00:22:50.293>go <00:22:50.502>to <00:22:50.711>the <00:22:50.920>toilet <00:22:51.129>quickly.

402
00:22:52.065 --> 00:22:53.845
<00:22:52.065>You <00:22:52.240>don't <00:22:52.415>just <00:22:52.590>walk <00:22:52.765>to <00:22:52.940>anybody <00:22:53.115>in <00:22:53.290>a <00:22:53.465>cafe

403
00:22:53.945 --> 00:22:55.845
<00:22:53.945>and <00:22:54.085>say, <00:22:54.225>Hey, <00:22:54.365>can <00:22:54.504>you <00:22:54.645>look <00:22:54.784>after <00:22:54.925>my <00:22:55.064>suitcase <00:22:55.205>for <00:22:55.345>me?

404
00:22:55.845 --> 00:22:58.005
<00:22:55.845>Because <00:22:55.952>you <00:22:56.060>don't <00:22:56.168>know. <00:22:56.275>He <00:22:56.383>is <00:22:56.491>a <00:22:56.598>bad <00:22:56.706>guy. <00:22:56.814>He <00:22:56.921>is <00:22:57.029>a <00:22:57.137>good <00:22:57.245>guy.

405
00:22:58.345 --> 00:23:00.285
<00:22:58.345>You <00:22:58.500>will <00:22:58.656>only <00:22:58.811>give <00:22:58.967>this <00:22:59.122>to <00:22:59.278>somebody <00:22:59.433>who <00:22:59.589>you <00:22:59.745>trust.

406
00:23:02.215 --> 00:23:03.835
<00:23:02.215>Uh, <00:23:02.564>then <00:23:02.915>as <00:23:03.264>I <00:23:03.615>said

407
00:23:03.835 --> 00:23:06.955
<00:23:03.835>before, <00:23:04.068>we <00:23:04.301>need <00:23:04.535>visibility <00:23:04.768>over <00:23:05.001>all <00:23:05.235>layers.

408
00:23:07.135 --> 00:23:10.035
<00:23:07.135>We <00:23:07.368>cannot <00:23:07.601>just, <00:23:07.835>uh, <00:23:08.068>monitor <00:23:08.301>network <00:23:08.535>layers

409
00:23:10.625 --> 00:23:14.115
<00:23:10.625>because <00:23:10.825>this <00:23:11.025>is <00:23:11.225>probably <00:23:11.425>not <00:23:11.625>the <00:23:11.825>place <00:23:12.025>nowadays

410
00:23:14.115 --> 00:23:15.515
<00:23:14.115>where <00:23:14.535>attacks <00:23:14.955>take <00:23:15.375>place.

411
00:23:17.095 --> 00:23:18.675
<00:23:17.095>And <00:23:17.295>then <00:23:17.495>if <00:23:17.695>all <00:23:17.895>this <00:23:18.095>is <00:23:18.295>in <00:23:18.495>place,

412
00:23:20.005 --> 00:23:23.515
<00:23:20.005>it'll <00:23:20.205>give <00:23:20.405>us <00:23:20.605>a <00:23:20.805>much <00:23:21.005>bigger, <00:23:21.205>uh, <00:23:21.405>possibility

413
00:23:24.055 --> 00:23:27.795
<00:23:24.055>to <00:23:24.335>detect <00:23:24.615>policy <00:23:24.895>violations, <00:23:25.175>anomalies, <00:23:25.455>non-compliance,

414
00:23:28.375 --> 00:23:32.515
<00:23:28.375>if <00:23:28.550>you <00:23:28.725>have <00:23:28.900>compliance <00:23:29.075>issues, <00:23:29.250>uh, <00:23:29.425>a <00:23:29.600>lot <00:23:29.775>faster

415
00:23:33.705 --> 00:23:36.395
<00:23:33.705>than <00:23:33.879>we <00:23:34.054>typically <00:23:34.230>are <00:23:34.405>able <00:23:34.580>to <00:23:34.754>do <00:23:34.929>it <00:23:35.105>if

416
00:23:37.725 --> 00:23:39.675
<00:23:37.725>we're <00:23:38.074>just <00:23:38.425>protecting <00:23:38.774>the <00:23:39.125>infrastructure.

417
00:23:51.065 --> 00:23:53.725
<00:23:51.065>So <00:23:51.220>again, <00:23:51.376>I <00:23:51.531>know <00:23:51.687>I'm <00:23:51.842>talking <00:23:51.998>about <00:23:52.153>an <00:23:52.309>ideal <00:23:52.465>world.

418
00:23:54.165 --> 00:23:56.085
<00:23:54.165>I <00:23:54.365>know <00:23:54.565>this <00:23:54.764>is <00:23:54.965>not <00:23:55.165>that <00:23:55.365>easy <00:23:55.565>nowadays,

419
00:23:56.145 --> 00:23:58.205
<00:23:56.145>but <00:23:56.378>this <00:23:56.611>is <00:23:56.845>something <00:23:57.078>we're <00:23:57.311>working <00:23:57.545>towards.

420
00:23:58.225 --> 00:24:02.525
<00:23:58.225>So <00:23:58.341>we <00:23:58.458>have <00:23:58.574>to <00:23:58.691>work <00:23:58.808>towards, <00:23:58.925>uh, <00:23:59.041>you <00:23:59.158>know, <00:23:59.274>if <00:23:59.391>we <00:23:59.508>come <00:23:59.625>back

421
00:24:02.525 --> 00:24:05.525
<00:24:02.525>to <00:24:02.875>our, <00:24:03.225>uh, <00:24:03.575>DevOps <00:24:03.925>lifecycle,

422
00:24:07.165 --> 00:24:11.495
<00:24:07.165>ideally <00:24:07.398>we <00:24:07.631>would <00:24:07.865>be <00:24:08.098>defining <00:24:08.331>what <00:24:08.565>kind

423
00:24:11.495 --> 00:24:15.095
<00:24:11.495>of <00:24:11.774>workload <00:24:12.054>we <00:24:12.334>are <00:24:12.614>publishing <00:24:12.895>during,

424
00:24:15.515 --> 00:24:16.695
<00:24:15.515>uh, <00:24:16.577>development.

425
00:24:17.355 --> 00:24:18.895
<00:24:17.355>So, <00:24:17.553>you <00:24:17.751>know, <00:24:17.949>here <00:24:18.147>we're <00:24:18.345>already <00:24:18.543>talking <00:24:18.741>like

426
00:24:19.215 --> 00:24:21.215
<00:24:19.215>security, <00:24:19.681>security <00:24:20.148>as <00:24:20.615>code.

427
00:24:22.195 --> 00:24:24.615
<00:24:22.195>So, <00:24:22.370>you <00:24:22.544>know, <00:24:22.720>we'd <00:24:22.895>be <00:24:23.070>tagging <00:24:23.245>our <00:24:23.419>workload <00:24:23.595>saying,

428
00:24:24.695 --> 00:24:26.655
<00:24:24.695>this <00:24:24.975>workload <00:24:25.254>is <00:24:25.534>a <00:24:25.814>database <00:24:26.095>workload

429
00:24:27.715 --> 00:24:32.535
<00:24:27.715>or, <00:24:27.889>uh, <00:24:28.064>uh, <00:24:28.240>a <00:24:28.415>service <00:24:28.590>workload <00:24:28.764>for <00:24:28.939>this, <00:24:29.115>uh,

430
00:24:33.035 --> 00:24:34.255
<00:24:33.035>for <00:24:33.584>this <00:24:34.133>department.

431
00:24:35.515 --> 00:24:37.975
<00:24:35.515>And <00:24:35.865>with <00:24:36.215>these <00:24:36.565>so-called <00:24:36.915>tags

432
00:24:37.975 --> 00:24:40.775
<00:24:37.975>or <00:24:38.149>these, <00:24:38.324>uh, <00:24:38.500>these, <00:24:38.675>uh, <00:24:38.850>name <00:24:39.024>value <00:24:39.199>pairs, <00:24:39.375>whatever

433
00:24:41.525 --> 00:24:42.975
<00:24:41.525>we'd <00:24:41.786>be <00:24:42.047>automatically, <00:24:42.308>we'd <00:24:42.569>be <00:24:42.830>able

434
00:24:43.135 --> 00:24:45.455
<00:24:43.135>to <00:24:43.415>automatically <00:24:43.695>generate <00:24:43.975>the <00:24:44.254>firewall <00:24:44.535>policy.

435
00:24:46.955 --> 00:24:50.095
<00:24:46.955>And <00:24:47.188>then <00:24:47.421>we <00:24:47.655>have <00:24:47.888>our <00:24:48.121>so-called <00:24:48.355>PEPs

436
00:24:50.155 --> 00:24:54.165
<00:24:50.155>or <00:24:50.355>policy <00:24:50.555>enforcement <00:24:50.754>points <00:24:50.955>close <00:24:51.155>to <00:24:51.355>the <00:24:51.555>data,

437
00:24:54.215 --> 00:24:55.485
<00:24:54.215>sorry, <00:24:54.596>one <00:24:54.976>too <00:24:55.358>fast.

438
00:24:56.345 --> 00:24:58.615
<00:24:56.345>So <00:24:56.695>you <00:24:57.045>no <00:24:57.395>longer, <00:24:57.745>uh,

439
00:24:58.875 --> 00:25:01.175
<00:24:58.875>you <00:24:59.030>don't <00:24:59.186>have <00:24:59.341>a <00:24:59.497>firewall <00:24:59.652>in <00:24:59.808>front <00:24:59.963>of <00:25:00.119>this <00:25:00.275>picture.

440
00:25:01.875 --> 00:25:05.455
<00:25:01.875>You <00:25:02.030>have <00:25:02.186>per <00:25:02.341>each <00:25:02.497>workload, <00:25:02.652>you <00:25:02.808>basically <00:25:02.963>have <00:25:03.119>a <00:25:03.275>kind

441
00:25:05.455 --> 00:25:09.175
<00:25:05.455>of <00:25:05.571>firewall <00:25:05.688>or <00:25:05.804>a <00:25:05.921>gate, <00:25:06.038>and <00:25:06.155>you <00:25:06.271>can <00:25:06.388>take <00:25:06.504>this <00:25:06.621>a <00:25:06.738>step <00:25:06.855>further.

442
00:25:10.275 --> 00:25:12.255
<00:25:10.275>You <00:25:10.430>know, <00:25:10.586>you, <00:25:10.741>if <00:25:10.897>you, <00:25:11.052>if <00:25:11.208>you <00:25:11.363>have <00:25:11.519>this <00:25:11.675>kind

443
00:25:12.255 --> 00:25:14.495
<00:25:12.255>of <00:25:12.410>concept <00:25:12.566>in <00:25:12.721>place, <00:25:12.877>you <00:25:13.032>don't <00:25:13.188>have <00:25:13.343>to <00:25:13.499>worry <00:25:13.655>about,

444
00:25:14.555 --> 00:25:15.935
<00:25:14.555>for <00:25:14.969>example, <00:25:15.383>encryption <00:25:15.797>anymore

445
00:25:16.605 --> 00:25:19.495
<00:25:16.605>because <00:25:16.760>you <00:25:16.916>can <00:25:17.071>let <00:25:17.227>this <00:25:17.382>piece <00:25:17.538>of <00:25:17.693>code, <00:25:17.849>this <00:25:18.005>piece

446
00:25:19.495 --> 00:25:22.415
<00:25:19.495>of <00:25:19.728>software <00:25:19.961>do <00:25:20.195>all <00:25:20.428>encryption <00:25:20.661>for <00:25:20.895>you

447
00:25:23.555 --> 00:25:28.215
<00:25:23.555>and, <00:25:23.710>uh, <00:25:23.866>uh, <00:25:24.021>it's <00:25:24.177>no <00:25:24.332>longer, <00:25:24.488>it's <00:25:24.643>basically <00:25:24.799>kind <00:25:24.955>of

448
00:25:28.775 --> 00:25:29.855
<00:25:28.775>included <00:25:29.099>in <00:25:29.423>the <00:25:29.747>infrastructure.

449
00:25:41.425 --> 00:25:45.035
<00:25:41.425>So <00:25:42.125>you <00:25:42.825>have

450
00:25:45.775 --> 00:25:48.235
<00:25:45.775>in <00:25:45.915>a <00:25:46.055>picture <00:25:46.195>like <00:25:46.335>this, <00:25:46.475>an <00:25:46.615>environment <00:25:46.755>like <00:25:46.895>this, <00:25:47.035>like <00:25:47.175>I,

451
00:25:48.235 --> 00:25:50.955
<00:25:48.235>like <00:25:48.409>I <00:25:48.584>said <00:25:48.760>several <00:25:48.935>times <00:25:49.110>already, <00:25:49.284>it's <00:25:49.459>pretty <00:25:49.635>clear.

452
00:25:50.985 --> 00:25:53.315
<00:25:50.985>It's <00:25:51.264>very <00:25:51.544>clear. <00:25:51.824>It's <00:25:52.104>not <00:25:52.385>easy.

453
00:25:54.735 --> 00:25:58.435
<00:25:54.735>Uh, <00:25:54.935>if <00:25:55.135>you're, <00:25:55.334>especially <00:25:55.534>in <00:25:55.735>a, <00:25:55.935>in <00:25:56.135>a,

454
00:25:59.775 --> 00:26:02.795
<00:25:59.775>in <00:25:59.930>cloud <00:26:00.086>environments, <00:26:00.241>we're <00:26:00.397>not, <00:26:00.552>uh, <00:26:00.708>you <00:26:00.863>have <00:26:01.019>public <00:26:01.175>cloud,

455
00:26:02.795 --> 00:26:05.155
<00:26:02.795>private <00:26:03.145>cloud, <00:26:03.495>for <00:26:03.845>example, <00:26:04.195>mixed,

456
00:26:05.215 --> 00:26:08.715
<00:26:05.215>or <00:26:05.389>you <00:26:05.564>have <00:26:05.740>some <00:26:05.915>of <00:26:06.090>your <00:26:06.264>cloud <00:26:06.439>deployments <00:26:06.615>in,

457
00:26:09.015 --> 00:26:10.795
<00:26:09.015>in <00:26:09.365>AWS <00:26:09.715>some <00:26:10.065>in <00:26:10.415>Asia.

458
00:26:12.015 --> 00:26:16.435
<00:26:12.015>Uh, <00:26:12.155>you <00:26:12.295>need <00:26:12.435>to <00:26:12.575>build <00:26:12.715>a <00:26:12.855>kind <00:26:12.995>of <00:26:13.135>a <00:26:13.275>system <00:26:13.415>around

459
00:26:16.625 --> 00:26:17.715
<00:26:16.625>what <00:26:16.952>already <00:26:17.279>is <00:26:17.606>available.

460
00:26:18.935 --> 00:26:21.455
<00:26:18.935>But <00:26:19.635>if, <00:26:20.335>if

461
00:26:21.555 --> 00:26:26.545
<00:26:21.555>and <00:26:21.695>when <00:26:21.835>you <00:26:21.975>get <00:26:22.115>there, <00:26:22.255>you, <00:26:22.395>you'll <00:26:22.535>really <00:26:22.675>be <00:26:22.815>able <00:26:22.955>to,

462
00:26:27.485 --> 00:26:29.145
<00:26:27.485>uh, <00:26:27.951>assert <00:26:28.418>full <00:26:28.885>control

463
00:26:29.245 --> 00:26:32.625
<00:26:29.245>and <00:26:29.419>have <00:26:29.594>full <00:26:29.770>benefits <00:26:29.945>of <00:26:30.120>a <00:26:30.294>cloud, <00:26:30.469>cloud <00:26:30.645>architecture,

464
00:26:33.095 --> 00:26:34.865
<00:26:33.095>agility, <00:26:33.795>quality, <00:26:34.495>scalability,

465
00:26:36.425 --> 00:26:37.905
<00:26:36.425>security <00:26:36.758>will <00:26:37.091>follow <00:26:37.424>the <00:26:37.757>workload.

466
00:26:39.005 --> 00:26:42.385
<00:26:39.005>And <00:26:39.180>you're <00:26:39.355>not <00:26:39.530>worried <00:26:39.705>anymore <00:26:39.880>about <00:26:40.055>deploying <00:26:40.230>the <00:26:40.405>workload

467
00:26:42.725 --> 00:26:45.725
<00:26:42.725>behind <00:26:42.958>security <00:26:43.191>or <00:26:43.425>behind <00:26:43.658>a <00:26:43.891>security <00:26:44.125>firewall.

468
00:26:46.475 --> 00:26:49.725
<00:26:46.475>There's <00:26:46.630>no <00:26:46.786>reason <00:26:46.941>anymore <00:26:47.097>to <00:26:47.252>discuss <00:26:47.408>with <00:26:47.563>the <00:26:47.719>security <00:26:47.875>guys,

469
00:26:49.785 --> 00:26:51.005
<00:26:49.785>Hey, <00:26:50.004>I <00:26:50.224>need <00:26:50.443>this <00:26:50.663>port <00:26:50.883>open.

470
00:26:51.725 --> 00:26:54.045
<00:26:51.725>I <00:26:51.865>need <00:26:52.004>to <00:26:52.145>talk <00:26:52.284>to <00:26:52.425>this <00:26:52.564>guy. <00:26:52.705>Uh, <00:26:52.844>it <00:26:52.985>doesn't <00:26:53.125>work.

471
00:26:54.155 --> 00:26:56.485
<00:26:54.155>Okay, <00:26:54.310>let's <00:26:54.466>open <00:26:54.621>all <00:26:54.777>ports. <00:26:54.932>Two <00:26:55.088>o'clock <00:26:55.243>in <00:26:55.399>the <00:26:55.555>morning.

472
00:26:56.915 --> 00:26:58.165
<00:26:56.915>It's <00:26:57.102>happened <00:26:57.290>to <00:26:57.477>me <00:26:57.665>so <00:26:57.852>many <00:26:58.040>times.

473
00:26:59.235 --> 00:27:01.205
<00:26:59.235>Okay, <00:26:59.468>I <00:26:59.701>open <00:26:59.935>all <00:27:00.168>ports, <00:27:00.401>everything's <00:27:00.635>working,

474
00:27:01.385 --> 00:27:02.565
<00:27:01.385>I'm <00:27:01.650>tired, <00:27:01.916>let's <00:27:02.181>go <00:27:02.447>home.

475
00:27:02.645 --> 00:27:04.005
<00:27:02.645>I <00:27:02.849>forget <00:27:03.053>to <00:27:03.257>close <00:27:03.461>the <00:27:03.665>ports <00:27:03.869>again.

476
00:27:04.005 --> 00:27:06.925
<00:27:04.005>And <00:27:04.160>all <00:27:04.316>you're <00:27:04.471>doing <00:27:04.627>is <00:27:04.782>living <00:27:04.938>with <00:27:05.093>a <00:27:05.249>major <00:27:05.405>security,

477
00:27:07.105 --> 00:27:08.725
<00:27:07.105>uh, <00:27:07.805>security <00:27:08.505>flaws.

478
00:27:09.825 --> 00:27:11.485
<00:27:09.825>Uh, <00:27:10.175>you'll <00:27:10.525>have <00:27:10.875>complete <00:27:11.225>visibility

479
00:27:11.585 --> 00:27:14.685
<00:27:11.585>and <00:27:11.785>control <00:27:11.985>over <00:27:12.185>communication <00:27:12.385>at <00:27:12.585>the <00:27:12.785>application <00:27:12.985>level,

480
00:27:15.425 --> 00:27:16.605
<00:27:15.425>not <00:27:15.690>at <00:27:15.956>the <00:27:16.221>network <00:27:16.487>level.

481
00:27:18.065 --> 00:27:21.725
<00:27:18.065>Uh, <00:27:18.415>again, <00:27:18.765>like <00:27:19.115>I <00:27:19.465>mentioned

482
00:27:21.725 --> 00:27:24.925
<00:27:21.725>before, <00:27:21.925>you <00:27:22.125>could <00:27:22.324>build <00:27:22.524>encryption <00:27:22.725>at <00:27:22.925>this <00:27:23.125>level

483
00:27:24.945 --> 00:27:27.445
<00:27:24.945>so <00:27:25.100>you <00:27:25.256>don't <00:27:25.411>have <00:27:25.567>to <00:27:25.722>worry <00:27:25.878>about <00:27:26.033>data <00:27:26.189>encryption <00:27:26.345>anymore.

484
00:27:28.745 --> 00:27:31.205
<00:27:28.745>And <00:27:28.919>kind <00:27:29.094>of <00:27:29.270>like <00:27:29.445>the <00:27:29.620>o <00:27:29.794>limp <00:27:29.969>of <00:27:30.145>security,

485
00:27:32.425 --> 00:27:34.445
<00:27:32.425>you <00:27:32.774>could <00:27:33.125>potentially <00:27:33.475>provide <00:27:33.825>continuous

486
00:27:34.445 --> 00:27:36.045
<00:27:34.445>compliance <00:27:34.911>at <00:27:35.378>real <00:27:35.845>time.

487
00:27:36.705 --> 00:27:41.565
<00:27:36.705>So <00:27:36.812>if <00:27:36.920>there <00:27:37.028>is <00:27:37.135>a <00:27:37.243>breach, <00:27:37.351>if <00:27:37.458>you <00:27:37.566>have <00:27:37.674>an <00:27:37.781>attack, <00:27:37.889>if <00:27:37.997>you <00:27:38.105>need

488
00:27:41.565 --> 00:27:45.405
<00:27:41.565>to, <00:27:41.740>to <00:27:41.915>react <00:27:42.090>to, <00:27:42.265>to, <00:27:42.440>to <00:27:42.615>something <00:27:42.790>bad, <00:27:42.965>uh,

489
00:27:45.745 --> 00:27:50.045
<00:27:45.745>you <00:27:45.885>not <00:27:46.024>just <00:27:46.165>have <00:27:46.304>your, <00:27:46.445>your <00:27:46.584>compliance <00:27:46.725>check <00:27:46.864>can, <00:27:47.004>can, <00:27:47.145>can,

490
00:27:50.145 --> 00:27:51.485
<00:27:50.145>uh, <00:27:50.547>alert <00:27:50.948>you <00:27:51.351>immediately.

491
00:27:52.665 --> 00:27:55.645
<00:27:52.665>And, <00:27:52.840>uh, <00:27:53.014>you <00:27:53.190>can <00:27:53.365>even <00:27:53.540>go <00:27:53.715>a <00:27:53.889>step <00:27:54.065>further

492
00:27:55.665 --> 00:27:58.445
<00:27:55.665>and <00:27:55.792>say, <00:27:55.919>you <00:27:56.046>have, <00:27:56.174>you <00:27:56.301>have <00:27:56.428>real <00:27:56.555>time <00:27:56.683>forensic <00:27:56.810>to <00:27:56.937>work <00:27:57.065>on.

493
00:28:05.355 --> 00:28:09.925
<00:28:05.355>So <00:28:06.055>I <00:28:06.755>used

494
00:28:09.925 --> 00:28:12.605
<00:28:09.925>to <00:28:10.065>have <00:28:10.205>a <00:28:10.345>boss <00:28:10.485>once <00:28:10.625>he <00:28:10.764>actually <00:28:10.905>finished <00:28:11.044>every <00:28:11.185>meeting <00:28:11.325>we

495
00:28:12.635 --> 00:28:14.045
<00:28:12.635>ever <00:28:12.952>had <00:28:13.269>with <00:28:13.586>this <00:28:13.904>sentence,

496
00:28:15.145 --> 00:28:19.765
<00:28:15.145>and <00:28:15.285>I'd <00:28:15.425>like <00:28:15.565>to <00:28:15.705>extend <00:28:15.845>it <00:28:15.985>with, <00:28:16.125>uh, <00:28:16.264>yeah, <00:28:16.405>have <00:28:16.545>fun,

497
00:28:20.695 --> 00:28:22.005
<00:28:20.695>build <00:28:21.088>some <00:28:21.481>cool <00:28:21.874>software.

498
00:28:22.265 --> 00:28:26.925
<00:28:22.265>But <00:28:22.392>I <00:28:22.519>think <00:28:22.646>we, <00:28:22.774>as <00:28:22.901>we, <00:28:23.028>we <00:28:23.155>as <00:28:23.283>developers, <00:28:23.410>we <00:28:23.537>are, <00:28:23.665>uh,

499
00:28:27.875 --> 00:28:29.525
<00:28:27.875>responsible <00:28:28.225>for <00:28:28.575>what <00:28:28.925>we <00:28:29.275>deploy.

500
00:28:29.865 --> 00:28:34.205
<00:28:29.865>And <00:28:30.005>if <00:28:30.145>we <00:28:30.285>stay <00:28:30.425>paranoid, <00:28:30.565>I <00:28:30.705>really <00:28:30.845>believe <00:28:30.985>strongly <00:28:31.125>that, <00:28:31.265>uh,

501
00:28:34.345 --> 00:28:39.285
<00:28:34.345>our <00:28:34.485>results <00:28:34.625>will <00:28:34.765>be <00:28:34.905>more <00:28:35.045>secure <00:28:35.185>in <00:28:35.325>this <00:28:35.465>ever <00:28:35.605>changing <00:28:35.745>world,

502
00:28:40.465 --> 00:28:44.485
<00:28:40.465>in <00:28:40.639>this <00:28:40.814>ever <00:28:40.990>more <00:28:41.165>dangerous <00:28:41.340>world <00:28:41.514>for, <00:28:41.689>for, <00:28:41.865>for,

503
00:28:44.505 --> 00:28:45.725
<00:28:44.505>for <00:28:45.054>it <00:28:45.602>workloads.

504
00:28:46.585 --> 00:28:48.685
<00:28:46.585>The <00:28:46.740>cloud. <00:28:46.896>The <00:28:47.051>cloud <00:28:47.207>is <00:28:47.362>a <00:28:47.518>fun <00:28:47.673>place <00:28:47.829>to <00:28:47.985>be,

505
00:28:48.745 --> 00:28:51.485
<00:28:48.745>but <00:28:48.861>it's <00:28:48.978>a <00:28:49.094>very, <00:28:49.211>can <00:28:49.328>also <00:28:49.445>be <00:28:49.561>a <00:28:49.678>very <00:28:49.794>challenging <00:28:49.911>place <00:28:50.028>to <00:28:50.145>be.

506
00:28:52.465 --> 00:28:56.565
<00:28:52.465>And, <00:28:52.605>uh, <00:28:52.745>we're <00:28:52.885>not <00:28:53.024>careful, <00:28:53.165>you <00:28:53.304>know, <00:28:53.445>I <00:28:53.584>don't, <00:28:53.725>I <00:28:53.865>I,

507
00:28:56.645 --> 00:28:57.765
<00:28:56.645>I <00:28:56.897>can <00:28:57.149>talk <00:28:57.401>for <00:28:57.653>Switzerland,

508
00:28:57.765 --> 00:28:59.605
<00:28:57.765>but <00:28:57.940>there's <00:28:58.115>not <00:28:58.290>a <00:28:58.465>day <00:28:58.640>which <00:28:58.815>doesn't <00:28:58.990>go <00:28:59.165>by,

509
00:28:59.605 --> 00:29:02.245
<00:28:59.605>which <00:28:59.805>I <00:29:00.005>don't <00:29:00.205>read <00:29:00.405>of <00:29:00.605>some <00:29:00.805>pretty <00:29:01.005>major

510
00:29:02.355 --> 00:29:05.245
<00:29:02.355>corporation <00:29:03.055>being <00:29:03.755>hacked.

511
00:29:06.465 --> 00:29:10.285
<00:29:06.465>Um, <00:29:06.605>let <00:29:06.745>it <00:29:06.885>be <00:29:07.024>ransomware, <00:29:07.165>let <00:29:07.304>it <00:29:07.445>be <00:29:07.584>data <00:29:07.725>stolen, <00:29:07.865>whatever.

512
00:29:10.865 --> 00:29:14.325
<00:29:10.865>And <00:29:11.020>I <00:29:11.176>think <00:29:11.331>it's, <00:29:11.487>it's, <00:29:11.642>it's, <00:29:11.798>it's, <00:29:11.953>it's <00:29:12.109>our <00:29:12.265>task

513
00:29:14.385 --> 00:29:17.285
<00:29:14.385>as <00:29:14.585>developers <00:29:14.785>to <00:29:14.985>to, <00:29:15.185>to <00:29:15.385>help <00:29:15.585>fight <00:29:15.785>this.

514
00:29:19.695 --> 00:29:23.155
<00:29:19.695>So <00:29:19.850>I <00:29:20.006>thank <00:29:20.161>you <00:29:20.317>very <00:29:20.472>much <00:29:20.628>for <00:29:20.783>listening <00:29:20.939>to <00:29:21.095>me.

515
00:29:24.135 --> 00:29:27.995
<00:29:24.135>Uh, <00:29:24.290>and <00:29:24.446>yeah, <00:29:24.601>I <00:29:24.757>will <00:29:24.912>hand <00:29:25.068>back <00:29:25.223>over <00:29:25.379>to <00:29:25.535>Stefan.