OK, welcome everybody to master class tonight.
Umm October 12th, starting at 8:00 PM to 10:00 PM.
Now which should help with the couple of hours of presentations
that we have.
I think moving it forward is gonna help everybody.
Umm, we can switch people around to make it.
The compatible with those that might be coming in late.
So it's just a matter of how we can work the whole thing out.
I, Kayla.
All right, so.
Let's see where we should start.
I hope everybody is having a good evening and ready for some
of these wonderful presentations, all kinds of
stuff going on tonight.
Let's see, we got Noah Smith.
Are you ready?
I am ready.
All right, go ahead.
Already.
It's that one.
OK, you are seeing a screen I hope, yes.
Yes, storage wars.
Storage wars.
All right.
We're going to talk about databases today, everyone's
favorite topic.
Alright, let's get right into it.
Let me start my timer, that'll help everyone out, I think.
OK, let's go.
So what I'm going to talk to you guys today is a little bit of an
overview of what SQL and Nosql databases are.
If you all aren't familiar, I hopefully I can familiar
familiarize you guys.
I want to show you some different servers that are often
used in the field and the main point of this project is to
analyze 3 different implementations of a database.
A relational key value and document stored database from a
business case perspective and the reason why I'm doing this is
I actually made this presentation for ancient
civilizations because they were having a database crisis, I
guess.
And so I kind of repurposed it for this.
So away we go.
What is a relational or sometimes called SQL database?
So these databases consist of tables where columns are
attributes and rows contain records with the unique ID.
This is the most common database layout kind of looks like a or
an Excel list.
They use logical database structures which allow for a
variety of functionality, including the creation of stored
procedures, views.
You can do different query types with this.
It allows for certain segregation that is very
helpful.
Uh, it is acid.
So if you guys don't know what acid is, I highly suggest you
look this up.
It's it could be a presentation on itself, but the main takeaway
is I want you to have from what acid is is it ensures data
consistency.
So if you make a change to your database, it will change the
database.
It can be transactional where if you have an event, that event
will either execute in its entirety, so change everything
you wanted to change or fail, and that's really helpful
because if you want to change something and half the things
change and the other half doesn't, you can really screw
yourself up and locking is a part of that where two
concurrent actions will not affect each other.
Relational databases are highly queryable.
Umm.
Basically any type of operation you wanna do you can do wanna
sequel database.
It can get limited in the no SQL world and I'll get into that and
the schema is well defined with all relational databases.
This is not necessarily the case with Nosql databases, so there's
a lot of different implementations with Nosql
databases.
It's a huge, huge field, I guess.
Uh, these databases generally do not have a schema or have a
loosely defined schema.
This is what if you Google Nosql.
This is why they'll be called flexible.
They often have faster query times, but are often limited in
query ability.
They are often cheaper in scale unless reach source intensive
per action and they can be acid.
Often they strive to be acid, but there's often limitations in
that, such as some don't support transactions and some take a
period of time to become consistent.
Here's some examples of common relational DB servers, Microsoft
SQL Server, MySQL, Postgres, SQL and and others.
And here are some no sequel database servers, so it's a
point out here.
You can see a key value database which I will talk about today, a
document stored database which I also talk about today, but there
are also many other types like graph databases, Collymore,
column oriented databases and time series databases.
Here are some graphs.
Or pie charts that I found helpful to understand.
Like what people are using in the real world and this is data
taken from Oracle hosting site.
So we can see that 60% of people use SQL implementations while
40% use Nosql.
Here are the servers that people are using, so the most common
one is MySQL, which is a SQL relational database and the
second one is MongoDB which is actually a Nosql database and a
document store database.
I missed a slide there.
Often projects will have multiple databases.
We can see that 44% of database or implementations will use
multiple databases and in this graph we can see that many
people 75% use both or if you use a multiple database
combination, many people choose to use both SQL and Nosql.
Alright, so things to consider.
This is the guns.
Or I guess your performance and implementation.
So what are the needs of your app when you're selecting a
database you want to consider what your needs are, so do you
need really fast read write speeds or must you support
transactions and do you need to be acid?
You also want to consider things like scale.
How big do you think your application will get?
And you also want to consider the practicality of implementing
that solution.
Some database solutions are are a little bit Phineas or more
more finicky than others and therefore require some more
attention to to really get the most of your money and the
butter.
So when you talk about these, it's always going to cost you
something to host your database.
And here are basically your options.
You can host locally, which is generally, people don't do that.
Sometimes schools do that if they have a, you know, a closed
environment, or if you're massive and you want to have a
whole data center, you can do local hosting.
But most people choose cloud hosting and within cloud hosting
you can have a precision server which you can imagine just
buying a computer and some far off land.
This is generally the highest cost, but the most predictable
performance you can go for a shared server where you
generally pay for the storage space, like how big your
database is, and the resources are pooled between whatever
provider you choose.
This this can have some costs associated with it, or you can
pay per read write so a database action will have a number of
reads and writes depending on.
Of course, the query and the action and this can be really
cheap if you know that your implementation doesn't have many
reason rights or it's not very used.
Or can it can get pretty expensive, so those are
basically your options.
So to get into the business analysis again, I crafted this
for the ancient civilizations project.
I will be comparing a key value database with Dynamodb hosts on
AWS Relational SQL Server AWS and a document with MongoDB
hosted with Atlas or also AWS.
You'll see what I mean.
There you will find different prices when selecting your
hosting and seek and server type.
But really, the most important part, and where you're going to
get all your pros and cons or selecting that schema which is
you know the key value relational document store part.
Alright, so here's what a typical key value schema looks
like.
We can see a primary key, which is how you.
How you know that each entry is unique and that's combined
comprised of a partition key and a sort key.
And then you have your attributes, which is basically
all the information you want to store per unique, uh, key.
And important to note with key value schemas is these
attributes don't have to be the same, so you could have one, uh
primary key that stores 10 different rows of data about
cookies.
And you could have another thing that's stores two different rows
of data about rocket ships.
It doesn't matter.
OK, So what are the pros of a key value database?
A good implementation is very performance and also very cheap.
This is because A1 table schema which is common or a few table
schemas which is common with key value database allows you to
sort items efficiently.
Uh.
I'm more about the the schema and I wanna outline that for
what I've been doing for ancient civs they wanted to use Dynamo
DB, so some of these slides will talk specifically about that,
but it's priced very competitively, so it seems like
with key value databases because of their simplicity, they are
often very cheap.
If you can make it work right, they're very fast and all of the
queries for Dynamodb were web web requests, so it can make you
know you don't have to create an API and your implementation.
You can just send a Web request out and get data back.
It's quite simple.
So what are the some of the cons of a key value database?
So it's not a catchall database.
There are many applications that Dynamo DB or key value databases
are not suited for.
It is really best if you have a situation where you're going to
need to access information very fast, and very often it's
optimized for large volumes of continuous reads and writes, but
it's bad when you want to get information nested within each
attribute.
So and this is a point, an important thing to underline
here, a querying Dynamodb where you want to gather an attribute
requires a scan operation, which basically reads your entire
database.
This is really bad.
You don't want to do that, OK?
Because of this fact, key value databases require planning.
This is because the primary keys and sort keys and indexes are
not immutable, so therefore you would want to know what's you
want your database schema to be so you can get the right keys
and therefore minimize the amount of impact to your
database.
There is some flexibility in this fact.
You can add indexes as you go.
You can also add attributes as you go, but having too many
indexes with a key value databases bad because it kind of
splits the database in ways that I don't have on this slide, but
I probably on my next slide.
Or maybe not.
Key value database.
Did I skip a slide?
I'm sorry certain method by which.
OK, I'm out of time.
I'm just going to move on, so I'm key value databases often in
my opinion aren't very practical.
Because of this need to have very defined indexes where a
high cost of getting those indexes wrong, it's generally
best if you have a planned out plan when you want to have a key
value database.
For the ancient Civ, I created this imaginary schema.
What I want to draw your attention to here is indexes.
How you can create your indexes?
Effectively, will make or break you with a key value database,
and you can do fancy stuff like have 10 different attributes
inside your key.
So right here I have a family key where family would represent
kind of a table and you could, you know, throw a ton of
different information in there and that'll help you to query
the database, because if you want to query database without
using a scan operation, you need to have an index for it.
OK, the cost of Dynamo DB which is a key value database is hard
to model, but using AWS pricing calculator I've discovered that
a lowest cheapest implementation possible in my opinion was
around a dollar per month.
Where to me an expected implementation might lead to
$7.00 per month.
OK.
So to tie everything together, you basically want to avoid
scans and you also want to minimize the number of indexes
and this will keep down your read write cost at the very
bottom.
If you don't want to do the pay per read write pay per read
write route, you have to get a server and that's going to cost
you around $60.00 per month, which you probably don't want
for a tiny project.
OK, so relational database scheme?
These, I think are most familiar to us.
We have tables which are these boxes the name of the table and
then you have your attributes inside the tables and those can
be joined together with foreign keys represented by the arrows.
OK, relational database.
Pros in my opinion they are easier to implement.
I think most people are familiar with them.
They fit almost every business case, so there are business
cases for, say, a key value database where if you need
transactions or something like that, it won't work.
But relational databases it almost always will work, but it
might be kind of slow.
You can accommodate many queries.
It's acid and poor database design leads to poor performance
and not increase costs unless you decide to pay more money.
OK, the cons of relational database, they will probably
always be more expensive and slower than a well implemented
in Nosql design.
When will it be slower?
When your database has high read write volumes, or if you have a
really massive database with many tables, entities and
entries, one will be more expensive.
Generally, when you get your application into the higher
bigger volume realm is when you'll start to see no SQL
databases start to pull ahead of relational databases and I'll
get into that briefly later for AWS hosting SQL Server, a lowest
case implementation.
Now there is a free trial which is important to note, but the
lowest implementation you can get is $17.00 per month and what
I thought might be reasonable for the project was $70.00 per
month.
Uh document store database this is I'll be talking about MongoDB
in this case.
These are stored in JSON like attributes which you can see
here.
It's just basically text string where each ID has attributes.
As you can see and then if you want to connect attributes
together, they have a foreign key and you can create that
relationship.
Umm so the the pros of this is kind of like a an in between
between a key value database and relational database.
MongoDB or document stores are more flexible than key value
stores.
You can query the data in different ways, but they also
have better performance than a relational DB kind of fits in
between.
There are also indexes which are intended to optimize with
document store, but it's not quite as crucial as with a key
value because these these indexes are mutable.
Umm, more people are familiar with MongoDB and it's probably a
better solution for ancient civs case than Dynamo DB.
Umm, the pricing.
So the pricing for MongoDB is complicated, but there's a free
period and then you have a couple options you can go to
paper, read, write route.
You can go the shared route or you can go the dedicated server
routes.
Umm, this was a cool thing.
I found this basically said this guy was talking about how he was
developing with a read write schema and he he basically got
ripped off.
He he was just doing some testing, writing some queries
and he he got stung with $155.00.
Bill, you don't want that.
Got to be very careful when you have a rewrite scheme and free,
so all of these implementations are free implementations, but
you might have problems if you try to run a production
application with a free service because a variety of reasons
really, and this was just an example of someone who was
trying to do that.
Uh, like this cost gradient?
Just quickly, there's basically a world where it's free.
It doesn't really matter if you do SQL or Nosql.
There's this in between space where in my opinion SQL is
better it it the the the cons of sequel don't really show up yet
and the simplicity of sequel makes it so you might be better
off in that case, but after you cross the $60.00 mark, in my
experience or in my research, no SQL databases start to become a
little cheaper.
This total cost analysis I I basically said all of this
already and to wrap up, I basically informed ancient Civ
that I don't think they should use a key value Dynamo DB
database, but there were enough pros and cons between a
relational database and a document store database with
MongoDB that both implementations would work and
that's my sources.
Thank you very much.
That was very good and keeping in mind that this is a self dev
project with a client, I mean it really comes down to what the
client really wants as far as the database, but we also want
to keep in mind what's going to work with continuing interns
being able to work on the site.
Yeah, that was a big consideration of mine.
They wanted to use a A, you know or Dynamodb, which is a key
value database and and I found it very complicated and I
thought others might also find it complicated.
So yeah, it was definitely something I was considering.
Umm can you tell me what they use?
That's what we like.
The two tier approach.
Yeah.
What do they use in the course itself?
In the database course, what are they teaching?
Uh.
Yeah, in almost all of my education, it's been almost
always SQL relational database stuff.
Usually no.
Right.
SQL gets like one class and key value might be one.
It's not taught.
Yeah, it might be like one chapter in one class.
You know what I mean?
It's just not, not as Todd. Yeah.
So that doesn't help.
It's more like when they come in here is when they get taught
right? So.
Yeah, I I I.
When they come in, they have a little bit of sequel and that's
about it.
So relational and SQL are really all that anyone knows when they
come in.
Right, yeah.
Yeah.
Yeah, I think even thinking when I was in the Masters class and I
took a database, I think it was the same thing.
You don't get much, but I learned a lot more.
Yeah, it was.
I mean, at least at least I had a full term of database.
That's what I'm thinking.
I thought that's what we had as well.
But it seems to me like we're only getting a few weeks of
database at any point.
So that's something that's going to have to be decided.
I'm glad that you gave us that information because that is
specifically we really need to know which direction we want to
go when it comes to the database and the and the the.
I mean, I think we're listing those probably going to be the
best.
So yes, most of us are more, umm, familiar with relational,
and I think that's the way the school's going with relational.
It'll be easier to move to a document form database if we
wanna go Nosql later like Mongo.
Right.
Yeah.
OK, that's lovely.
So we'll have to bring up.
Thank you so much for that presentation.
That was awesome.
Thank you.
Very good.
Let's see.
Is Caroline here?
She may not be in yet.
Might have to put her on for later.
I've been trying to call so we'll just keep trying.
OK.
Adam, we're going to jump to you.
Alright, I guess get this over a little sooner then.
Alrighty, take it away.
All right.
Let me quick share.
All right.
Can you all see?
No.
At least not yet.
Hmm, OK.
Me.
Try it this way then.
Is that better?
Yes.
Yeah.
OK, I don't know.
Got it.
I I I did it.
Uh, differently, I guess I.
All right.
Well, without further ado, I'm Adam.
This is uh, I'm going to talk a little bit about how technology
and data is being utilized in football, specifically the NFL.
So I am sorry soccer fans, but we won't be going over that.
Umm.
So just to uh, go over some points here first, I'll go over
most of these in depth later on.
We wanted to give a brief introduction to some important
points.
Umm, the NFL has started utilizing technology to improve
their their protective equipment, primarily their
helmets in an effort to cut down on concussions and head trauma
that comes with a, you know, tackling or getting tackled.
I'm in the NFL has also begun using technology to predict and
decrease the risk of injuries to players by using artificial
intelligence and machine learning, and another way
technology is being used is to create better experiences.
You know, for the fans, more interactive methods at games and
at home, umm, and then the NFL is also using NextGen stats for
a little while now and it's used to kind of gain an insight into
how our favorite players are performing, how the teams doing,
stuff like that and there's tons of more ways that this
technology and other technology is being used in the game.
But I just kind of felt like these were some of the more
important and noteworthy ones.
It is important to note that since the NFL is investing in
players safety through these methods, players will
potentially have the chance to have a longer and more
successful career, which is something you know the league
players and fans alike will appreciate in the long run.
It's moving on the the helmet technology is super cool thing
and you know, while all protective gear is important for
football players, I think the helmet would arguably be the
most important nowadays since the 2018 season, the NFL,
they've continued to change and improve upon players helmets.
They collect data and work with people in the medical and
engineering fields to develop helmets with custom protection
based on the player themselves.
And then also their position, umm, so examples of this include
the quarterback and also the offensive and defensive lineman.
Uh quarterback helmets are new for this 2023 season, and they
are performing about 7% better than the most popular helmets
that were worn by QB's last year.
QB's last year and these improvements are happening
pretty quickly too.
Too, uh.
Since 2027, of the previously highly recommended and top
performing helmets, they're now prohibited from use in the game
as of the 2024 season.
So next season, those helmets, they won't let you wear anymore.
And on the side, there is the most recent lab results from
2023, umm.
And just to break it down, the dark green and the shorter lines
are the best performing helmets, the ones that limited the head
impacts severity the most.
And that's of course, followed by the light green lines and
then the yellow, and then finally those red lines at the
bottom or the red block at the bottom.
There is those seven previously highly, you know.
Highly recommended helmets that will be prohibited soon, umm.
And within the last five seasons, there's been about a
25% reduction in concussions to players.
Thanks to these improvements, in additionally over the past four
season, nearly 99% of current players have and where these top
performing helmets compared to about 50% when this first
started.
So that's a significant jump, which is great.
Umm, but of course those 1% of players that are still wearing
the prohibited and like unrecommended helmets, they are
still potentially at a higher risk of head trauma and even
finds if the NFL so chooses.
I'm so predicting and preventing injuries since 2002 on nearly
fifty rule changes have been made, and this is to of course
help the protect the players from injuries.
I'm not.
All of them are super popular with fans and players, but like
I said, most of these are intended to reduce harm on, and
the NFL has since partnered with AWS and adopted.
Both artificial intelligence and machine learning to assist in
predicting and preventing injuries to players.
And by collecting data from sensors in equipment helmets.
Uh, mouth guards and then also using video analysis of players.
The NFL is able to understand how and where these injuries are
occurring on the field.
Using this data and more, the NFL and AWS Machine Learning
Solutions Lab can create virtual representations, also referred
to as the digital athlete, and perform simulations on them to
observe the impacts of various things.
These things include stuff like the impacts of fatigue, the
weather, you know, whether it's raining, whether it's super
sunny and dry, the equipment they're wearing, so that those
helmets, again, the rule changes fields.
So you got natural grass fields and then turf fields and turf
fields aren't very popular and then a lot of other stuff.
And from here a player can get a risk level that they can then
begin to develop personalized trainings.
Recovery plans after game days or after injuries, and then they
can make improvements and changes to their equipment and
saw a little use.
Example of this includes the Seattle Seahawks and their logo
is there on the right side and the the Seahawks use Amazon Sage
Maker, which is a machine learning service and they use it
to assess the performance of their players.
And then make appropriate changes to their coaching and
then get advice on how they can improve and mitigating injury
while also improving their performance in two ways.
They use this is through their QB's.
They use it to see how their Cubs react to hurries.
Uh rushes and sacks, that sort of thing.
And then they also use it on the opposite side, with their
defense to help them improve the chance that was of getting
hurries and sacking their opponents cubbies.
Alright, so next Gen stats next Gen stats has been a thing since
about 2017 in the NFL, and AWS teamed up to create this.
It provided a new way for them to look at statistics of the NFL
using machine learning, and through this program, uh, the
NFL can look at, excuse me at real time stats that are often
used by broadcasters to add just a little bit of additional
context to plays as they unfold.
And by collecting data using ultra wide band receivers and
RFID tags that are inside of shoulder pads and footballs and
other equipment and then comparing it with historical
data, the NFL is able to observe patterns.
And then also make predictions for the likelihood that playlist
succeed.
So say QB is throwing the football into maybe double
coverage or triple coverage.
You know, that's not very likely to succeed in that throw,
whereas if they're just throwing it to somebody, that's one on
one, there's a much higher chance that that pass will
succeed.
Umm.
And they'll do you know better in the long run.
And these next Gen stats, they can be used to break down a
player's movements, stats, and even create graphs and models
like the one I've got on the right side of the screen here
and that displays Anthony Richardson.
Uh, who's the QB?
One for the Colts.
Uh.
My team and it's the IT shows his breakdown of his throws
during his game in week four against the Rams.
So as you can see, it shows where the ball was thrown and
then it also gives you an idea of how far it was thrown.
The number of completions versus attempts and in an even
highlights the two throws that resulted in a touchdowns that he
threw.
And so these next Gen sets, it's a super beneficial way for fans
and players alike to understand how the game is being played,
how well these players are playing, and then also how they
themselves can improve.
Uh.
And additionally, a lot of scouts now are able to use this
to help determine how potential prospects could perform in the
NFL.
So before you know drafting somebody you wanna have as much
data as possible.
So you can say, oh, this person is really great.
We need to draft them as soon as possible or this could be a risk
we may want to hold off for a little bit and see if we can get
them later.
And so you know, of course, this technology also benefits the
fans. Umm.
And in two ways with interactive apps, it can be through fantasy
football and online betting.
Individuals had this opportunity to engage more actively on those
Monday, Sunday and Thursday football games.
I was going to put a screenshot of my own fantasy football team
from the past week, but I did very poorly so I I skipped that.
I'm sorry.
So moving on, I, uh nowadays nearly all football teams also
have social media such as, you know, Instagram, Facebook,
Twitter or X and Tick tock.
And that just allows them to engage with fans in real time,
you know, post updates about players, about their health.
You know, if they're dealing with injury or also do
promotions through the team, whatever, maybe.
And additionally, stadiums now have a high density Wi-Fi that
fans can take, you know, take advantage of and use and benefit
from when they're at the football game.
If they need it.
And also that there's a new Madden football games every
every year, video games that player or team.
Excuse me, fans, can you know, play as their favorite teams.
Layers simulate themselves in the game if they feel like it,
and while these aren't necessarily new, you know
they've been 25 years of them or something like that.
They've just, you know, gained improvements throughout the
years and now they're crazy, you know, realistic and everything.
Umm.
And another cool thing that the NFL is working on is the
opportunity for fans to have a VR experience.
Umm to make them feel like they're at the game while
they're sitting in their living room, they're bedroom.
And so it would make it possible for them to be on the sideline
watching the game, you know, from the 50 yard line, you know,
where the where the players would be or would the coaching
would be.
So it's just a whole new experience for people to really
take advantage of and try out.
It's this is one last thing.
This is a really cool UM.
Every year, the OR for the past four or five years, every year,
the NFL has hosted a competition for individuals that are
enthusiastic about data and analytics called the Big Data
Bowl.
And it just provides people with the opportunity to use football
data and those next Gen stats to develop new ways to improve the
NFL.
And also it has provided the opportunity for several
individuals to find employment.
Around 30 people have actually found employment from this
competitions and last year's winner.
He he was Korean and he he developed a new way to use the
artificial intelligence that actually improved the.
UM.
Ability to determine injuries by about 31%, so fairly significant
UM advantage there and I believe you actually got a job two out
of this, but yeah.
So I mean, if you're ever interested or wanna get a job in
sports, maybe consider looking at this, seeing what sort of
stuff is being developed and maybe try it out for yourself.
Umm.
These are my references and a few more.
Thank you and I hope you learned a little something interesting
that you know you can take away from this.
Great job.
I know you know.
I think the coaches and the owners use this data also to
keep or remove or trade players as well, don't they?
Yes, they actually at anytime I forgot to mention it, but at any
time during a football game, a coaches get a Microsoft Surface
tablet that isn't connected to the Internet, but it still has
all this information on it that they can use to take advantage
of to say like umm, should we run this play now at like 4th
and 10?
Or should we?
You know, should we, should we go for it on 4th or should we
wait?
You know, that sort of thing.
Like, what would the likelihood of them getting it, getting that
extra down be so yeah, they're they're actively using it even
during the game.
The dog that I think the Dolphins coach is one that uses
it a ton because he's all about data and schematics and outcomes
for his teams.
That's why he's like focused on speed with everything, and he
Yeah.
Yep.
even did it like in a postgame conference over the weekend.
And I think he like referenced a lot of what Adam was just
mentioning and was talking about the data that comes from
everything with the players.
It's.
Yeah, it's crazy what they've done.
I know.
Yep.
Makes a good team.
Oh yeah.
Awesome.
Very good, excellent presentation.
Are dated.
Good job.
Driven world, yes.
Yes it is.
Oh yeah, for sure.
Umm, I think we were using it within when it wasn't so big.
Thank you.
Anyways too, you know, I mean.
Umm.
Yeah, it was just the old generation stats.
I know.
Yeah, exactly.
I know when I'm in the car and I'm saying it's dinner time,
it's the three of us who have to decide and the date it is, who's
going to get, what is it? 2.
Two to three, you know.
So rationally we decide who's going to decide who's getting
dinner or what kind of dinner.
So yeah, I I think it's used all the time.
We don't even realize.
Oh yeah, for sure.
Alright, let's go on with who's next year on the list, Kristian.
Yep.
Hello, can you hear me alright?
Take it away. Yep.
This one.
Alright.
No.
I think he dropped.
Or got kicked out.
Yeah, he dropped it.
He disappeared. So.
Yeah, I think he got dropped, OK.
That's happening a lot.
Recently I've been dropped quite a few times.
Yeah.
Ohh Microsoft likes to mess around with their system.
And how, Caroline, I don't think she's in yet either.
Right, like.
I guess we could go on a Shawn.
And then.
Till Christian could get back on.
OK, we can do that.
Me.
Great.
Sitting at this to work.
OK.
Is this showing?
That's not what I want right there.
OK.
Is this showing just the PowerPoint?
Yes.
OK, good.
Alright.
Ohm.
Excuse me, I wanted to talk about a AI and cybersecurity and
discuss the good and the bad associated with it.
Go down to the bottom of your PowerPoint, click the the icon
that looks like a book or slideshow.
Yeah, whichever one.
OK.
There you go.
Ohh yeah, there you go.
OK, sorry about that.
I'm still trying to figure how to use the share thing and
figure that out.
Are in this, uh, this presentation I wanted to start
it off by discussing basically what is artificial artificial
intelligence and kind of get like a brief history of it
afterwards.
Wanted to talk about the good and give and it a case study of
the advantages of advantage.
Then talk about the bad associated with using artificial
intelligence and cyber security and finish it off with a general
conclusion.
So what is artificial intelligence?
As I said before, I'm going to be giving a brief history, so
the very beginning idea of artificial intelligence
essentially started with the a publication of Rossum's
Universal robots written by the Chez playwright.
Carl has kept caspak.
I'm sorry.
Umm, during that publication was the first ever use of the term
robots?
Uh.
Later on in 1929, was the first Japanese robot built by Makoto
Nashi. Mora uh.
Named Jakub Tensilica, which is shown on the right.
And then later on was a publication of Giant Brains or
Machines that think.
Uh.
Published by Edmund Kalis Berkeley in 1949.
Are the first drew understanding of artificial intelligence was
brought about with the public?
Are the written writing and publication of computer
machinery and intelligence in 1950 by Alan Alan touring who
also developed detouring to us, which was used to test machines
ability to mimic humans, to put it basically.
Uh.
Later on I forgot to put the date.
Oops, there was also the Artificial Intelligence workshop
which brought about the first use of the term artificial
intelligence and was held by John Carthy.
In a more recent time, there was the the programming of deep blue
in 1997, which was the first program to be a human be the
human chess champion, Garry Kasparov.
NASA also utilized artificial intelligence with the launch of
are the launch in navigation of Spirit and opportunity in 2003,
which were uh Mars Rovers, which are able to navigate the planet
surface without human intervention.
And later on in 2011 was Watson ANOP computer created by IBM.
Which one jeopardy against two of the former champions?
And in the modern times and I.
There was Alibaba's language processing AI and 2018, which be
human intellect on Stanford, Reading and comprehension tests.
There was also the development of chat, GPT 3 and more recently
4.
Which uses deep learning to create literature or depending
on the user's preference, answer questions and also in 2021 was
dollar E which was able to process understand images and
can also create AI generated images.
Now onto the good of AI in cyber security.
Some of the benefits of it can include uh using it for a hybrid
cloud Environment Protection, which has the ability to
identify a shadow data monitor for abnormalities, and alert
security teams.
It also has the ability to for a I'm sorry now also has the
ability for a threat prioritization and accuracy.
Which summarizes which create summaries for high fidelity
alerts and can automate responses to any kind of.
Breaches or malicious activity.
Uh, it also has the benefit of these of user access needs and
security by which can analyze and verify users based on
behavioral data and can help reduce fraud considerably.
Additional benefits includes the new threat detection, which uses
a sophisticated algorithm to detect malware, identify pattern
recognition and detect early malware and ransomware exempts
and also has the capabilities of bot detection to analyze, which
by analyzing vast amounts of data and alert security teams to
adapt their strategies.
As well as endpoint protection, which as up to date signature
protection to identify these kinds of malicious activities
and creates a proactive protection against threats
rather than a reactive response whenever an alert happens.
And the.
Kept Gemini Research Institute reports reinventing
cybersecurity with artificial intelligence publication.
Which had a survey that reported on 850 securities executives IT
security and IT operations across 10 different countries,
which found that three out of four say AI loss or password
response to breaches.
Uh, 69% of his executives say that AI is necessary for
response, and three out of five firms use AI to improve cyber
analyst accuracy and efficiency.
A case study of the advantage is the United family healthcare in
China.
In 2020, they began evaluating their security infrastructure,
which it did not possess.
A Security operations center and they needed to implement a
solution that was easy to install, update and use with
very little product knowledge or training.
UFH conducted a proof of concepts and found that IBM
Security Q radar seem stood out due to his capabilities and it's
easy abuse.
With limited training, the users could view prioritized threats
centralized their log management, and create internal
and external audit report generation.
These are some quotes from Choo Choo Ping, the medical
Information security manager at United Family Healthcare.
Uh.
To summarize, the IBM solution allowed them to discover plain
text usernames and passwords and system, which is a huge security
risk, and IBM solution also had a bunch of had a lot of preset
built-in rules.
Uh, that were very comprehensive, can easily detect
more risks allowing allowing for its efficiency, time saving and
it's labor and cost.
No, but the bad parts of using AI for cyber security, some of
the risks associated with AI includes the possibility of
higher chances of data breaches, which are vulnerable due to weak
security protocols, weak encryption or access controls,
and internal threads.
Uh, a higher chance of data threat data theft of large
amounts of logged or stored data.
And data breaches are have the potential to increase due to Gen
AI projects, which includes GPT 4, phone two and all other open
source variants.
Additional security risks includes increases in malware
and ransomware, which due to a I there's a lowered cost towards
now origination which can lead to new variance quicker and
cheaper productions of malware with less skill required.
And now we're and we're also leads to towards service
disruption through encrypting data or overloading networks.
And there's also the chance of resource hijacking through for
the use of crypto mining or botnet attacks.
There's also model poisoning, which targets AI and development
or testing.
A malicious user can input data to influence the output, which
leads to incorrect or biased predictions and inaccurate or
unfair decision making, which could be a major risk towards
organizations who rely on AI for decision making processes.
And model poison is also subject to damage without security
controls and measures.
Possibly a security risk that's on a lot of people's minds is
the privacy associated with it.
The use of personally identified information or PII for model
training is concerned for a loss of sensitive information through
a data breach.
Uh model explained ability Ohm, which could have issues if they
need to update a system or explain how the system works and
it it can cause a lot of trouble.
Others also the risk of third party access and data sharing.
Umm, a.
The problem with data retention and deletion and a huge a major
concern for surveillance and profiling of data that is logged
or stored.
In conclusion, some of the some of the main advantages of AI and
security is through identification and protection
and the ease of use for organizations.
Although the disadvantages is through the creation and
implementation and the ease of use for malicious users, so and
summary is artificial intelligence good or is it bad?
Personally, I believe it is subjective.
Artificial intelligence is a tool that can be used to bring
both strong security measures to a system and the ability to
bring down the same system.
It depends on who uses the tool.
And I wanted to add this quote cause it it coincides, but this
is by Sarah Jeong.
Artificial intelligence is just a new tool, one that can be used
for good and for bad purposes, and one that comes with new
dangers and downsides as well.
We know already in that all the machine learning has huge
potential data sets with integrated bias to produce
biased results.
Garbage in, garbage out.
Uh.
If anybody has any questions I do have like a minute or two.
Umm, but real quick.
Yeah.
These are my.
That's my reference.
Yeah, I have a question because recently you probably have seen
there was articles out about how chat, GPT IQ is now near
Einstein level.
So how?
How would you factor then if it's just a tool?
Umm I.
Is that means that whoever uses it is gonna have their IQ raise
to that level?
Umm, the way that I perceive it is AI.
AI is a tool, same as a lever, and a fulcrum is a tool.
It using a lever to move an object.
It does not necessarily show how strong you are, but issues which
can do with the right tools.
I believe the same way with artificial intelligence chat,
GPT or anything like that.
It's not the user who is presenting that information.
Is that user using a tool to?
Bring about that information, which they can then.
Uh use themselves?
That makes us strong argument.
If you're not using it, you're a disadvantage.
Right.
Hey, there's also the argument that if you're no good at, it's
not going to help you anyways.
And that's me.
Oh, well, hold it if this is actually gonna raise your IQ to
Let.
1:55, I'll take advantage of that.
Cause I could use a boost.
Me too.
So maybe I should learn it.
Then again, it also depends on how you identify what an IQ
measures of like.
I don't mean to step on toes or anything, but to my
understanding and IQ test measures, somebody's ability to
retain information rather than what they know.
No, no, it absolutely fits right into the natural learning
process modeling.
So yeah, so I don't think I really believe that that came
out.
I was like, yeah, it it it, it caters to the exact strength of
Right.
chat GPT.
Right.
Yeah. OK.
Umm, something to think about?
Well, thank you, Sean.
That was great.
Very nice.
Good job.
Alright, Christian, you're back.
Yes, I'm so sorry about that.
No problem, it happens.
OK, so let's let's do this one more time.
Can anybody see my screen?
It's black to me.
Not yours.
I still see Shawn's so.
I see black.
OK.
There's Rick says darkness.
Of course, that could have another color, another car
Doing this.
connotation.
Right.
I see darkness.
So uh, do you have your PowerPoint open?
OK, so when you go into share, choose the UM screen or window,
for that we'll choose the screen.
Not yet.
It may be going slow right now too, so.
So yours is.
Still on AI security, the good and the bad.
So not sure why.
Sean, are you?
Did you unshare?
Ohh.
Yeah, I feel like Sean still sharing his screen, so might be
the issue right now.
Yeah, right.
OK.
Uh, I gotta stop sharing myself too.
Got something?
Yeah, that was me sharing on accident, of course.
OK, so can can.
Well, then you took control.
Set right.
Now you can release it.
So now I'm no longer sharing.
So you should have it now, Cristian.
OK.
So can you see my screen?
No.
Back.
OK, how about now?
Strengthening security.
Strong password policies, yes.
Alright.
And now?
Yes, perfect.
All right, it's this.
So today I wanna talk about how having a strong password policy
can strengthen your business security.
So small businesses find themselves increasingly reliant
on technology and digital platforms to conduct their
operations.
While this advancement offers numerous benefits, it also
brings new challenges, including the need for strong password
policy and this presentation.
I would like to explore the critical importance of strong
passwords.
Discover the characteristics of strong passwords, discussed the
development and enforcement of password policies, and highlight
what are the best practices for having a strong password.
So strong passwords are the foundation of digital security.
They act as a formidable barrier against unauthorized access and
data breaches in the context of small businesses.
Strong passwords matter for several reasons.
First, small businesses often handle sensitive customer data,
financial records and proprietary information.
Week passwords can put this information at risk, leading to
severe consequences such as financial losses, damage,
reputation and even legal repercussion.
Cyber threats, including phishing attacks and boots,
force attempts around the rice strong passwords serves as the
first line of defense against this threat, making it
significantly more challenging for attackers to beat your
system.
Many industries have regulatory requirements that mandate strong
password policies.
Noncompliance to these industry standards can result in
penalties, fines and even legal consequences.
The correct Eric characteristics of a strong passwords are, uh,
longer passwords are more secure because they make it harder for
hackers to guess potential password combinations.
The complexity of breaking a password improves dramatically
with a minimum of 12 characters, making it a strong protection
against brute force and dictionary assaults, and
improving overall cybersecurity for your accounts and data.
To increase complexity and resistance to hacking a strong
password compromises upper.
I'm sorry, comprises uppercase and lowercase letters, digits
and special characters.
Because of this diversity, the password is less likely to be
quickly broken by hackers employing brute force attacks.
Also, strong passwords must avoid information.
They might be easily guessed avoiding using phrases or
patterns that are often used, such as password 123 or 123456.
Dictionary attacks are frequently used by hackers to
quickly decipher these passwords.
Instead, choose unusual combinations that are more
resistant to computer guessing.
Using unique passwords for each account and system reduces the
possibility of a security of security breach having far
reaching consequences.
Others are safe if one account is compromised, limiting the
potential harm in the event of a compromise.
This isolation method is a crucial security safeguard.
Passwords should be changed regularly to reduce the danger
of illegal access.
Let us swords are made less valuable to potential attackers,
even if they're hacked, by updating them at a regular
intervals.
However, there need for user to properly remember and manage
their passwords.
Should be balanced with the frequent changes.
Yes.
Ensure the implementation of strong password is essential to
create a well defined password policy.
You must define the minimum length, character type and
uniqueness for passwords.
You should also set a deadline for employees to update their
passwords to maintain security.
Nest recommends performing this every 90 days.
You should update your password more frequently if you work in a
sector where security is more strictly enforced, such as a
bank.
Configure systems to temporarily lock out accounts after a
predetermined number of consecutive failed logging
attempts to develop account lockout procedures.
Give users easy access while keeping security by providing
clear instructions for password recovery, including phone or
email options for password resets.
Explain how passwords will be sorted and encrypted to prevent
unauthorized access to stored passwords.
Passwords are commonly stored using cryptographic techniques.
They are hashed A1 way transformation using algorithms
like SHA 256.
The result?
The resulting hash is stored and not the actual password.
During authentication, the entered password is hashed and
if the hash is the same as the one that it's stored, then
access is granted.
You should also create training courses with engaging models,
workshop and materials.
Discuss the needs to use strong passwords and the dangers of
using weak ones.
Employee password managers and teach staff members how to build
complicated one of a kind password stress the importance
of consistent upgrades and safe storage.
Now establishing a password policy is only the first step.
It is also crucial to enforce this policy effectively.
Small businesses can implement the following strategies.
You should conduct regular training sessions to educate
employees about the importance of strong passwords and how to
create and manage them.
You should implement password management tools that facilitate
secure password storage and generation.
Conduct periodic audits to ensure compliance with the
password policy and identify weak passwords.
You should implement role based access control to limit the
information accessible to each employee, reducing the risk of
unauthorized access.
Incorporate the following best practices to fortify your
password security.
Cyber criminals frequently employ phishing to deceive
people into disclosing their credentials.
Be wary of unsolicited emails, text or links that ask for your
login information.
Check the senders legitimacy and refrain from clicking any
dubious links.
Password need to be kept in a safe place.
Do not record them on a paper or in a readily available digital
file.
Utilize password management software a tools to secure and
encrypt your credentials.
Password sharing should be avoided because it can
compromise your security.
Even with people you trust the best course of action is to keep
your login information private.
If you need to access to grant access to someone, think about
doing those safely using a trusted password management
manager and password sharing.
Password managers create secure one of a kind passwords for
every one of your accounts.
Store them safely and automatically fill out logging
information as necessary.
They also provide a simple, safe solution to manage your
password.
Protect your Wi-Fi network with a password to stop connectorized
access, use WPA3 and strong router passwords to increase
data.
You should use public Wi-Fi networks with caution since they
can be unsafe and open open to eavesdropping.
If you want more protection when utilizing a public Wi-Fi, think
about using a virtual private network VPN.
In a time dominated by uh digital transformation, strong
password policies have become an indispensable aspect of small
business security.
The protection of sensitive information, the mitigation of
cyber threats and compliance with regulatory standards all
hinge on the quality of password security.
By encouraging traits of strong passwords, developing a
comprehensive password policy, and enforcing password security.
Small businesses can substantially reduce the risk of
data breaches and maintain the trust of their customers.
Embracing best practices ensures a dynamic response to evolving
threats.
So in conclusion, to adopt the adoption of strong passwords
policies is not just an option, but the requirement for all
businesses looking to thrive in the digital landscape.
It is a shield against the rising tide of cyber threats
safeguarding your businesses, your customers and your
reputation.
Your business should act proactively.
Embrace the best practices and make robust personal policies.
But nonnegotiable priority in a digital security strategy.
Thank you.
If you have any questions or if you want something to add, I
would like to hear from you.
Umm.
If I had a dollar for every single time as a help desk
employee that I've had to reset someones password and I was
trying to demonstrate a complicated password and they
wanted to fight me at every single step.
Ohh, I'd have so much money.
I know what you mean, but it's it's like I think it's one of
the most important things that that you can do to safeguard
your.
Your company.
Absolutely.
Yep, you need to change it often.
Good job.
Yeah.
Thank you.
Yeah.
So next recommends about 90 days, but I know from people who
work in the financial industry, they say they they change the
passwords every 30 days.
Yeah, that makes sense.
Yeah, I think the more important like that they probably they
should absolutely.
Yeah.
That was great.
A lot of information. Excellent.
But thank you.
I think we'll go ahead and jump to Jeff, wait and see if
Caroline shows being that you know, I changed the time without
really telling everybody.
I'm waiting for feedback from her as well.
The Jeff, if you take it.
Peer ready.
Does that look OK?
I see.
I see Penguin.
Yes it does.
No, you can't see the bottom of the my my.
Yes, I do.
I I'm sorry.
Yes, I can see this.
This the full slide, yes.
OK.
Thank you.
So there are countless individuals that are responsible
for the development of pretty much every aspect of digital
technologies.
I'm just gonna highlight some of the key moments and individuals
responsible for the development of Linux.
And so Derek, the soya price really didn't have anything to
do with computer science.
He was a sociologist and a scientific historian, but price
is low, kind of relates to the idea that it's small number of
individuals within a particular organization are responsible for
the majority of production.
Essentially, the square root of the total number of members for
any collaborative effort represents a segment of the
group that provides about 50% of the results, and this is pretty
much applicable in every domain, including the development of
modern operating systems.
The story of Linux kind of begins at MIT in 1961.
This is about the time that we've kind of first came up with
the concept of file systems.
The initial exploratory project that MIT was called mathematics
and computation, and it was led by Robert Fano.
He was a researcher at MIT, but the kind of the big guns was JCR
licklider.
He was a real big contributor to the project.
Use it.
Actually, a computer scientist and a psychologist that
developed all kinds of other time sharing systems and
advanced our understanding about psychoacoustics and PBS.
That's kind of a big deal.
And he also came up with the concept of the World Wide Web.
He just didn't use those words.
The contemporary protocol to communicate with satellites is
named after him, so the Mac project title was later changed
to multiple access.
Computer machine aided cognitions kind of the root of
AI.
The compatible time sharing system was primarily coded in
the Michigan algorithm decoder.
Well, part of it was in Fortran and this was uh, designed to use
on couple earlier IBM machines for the second version of CTC
came out in 1963.
In this kind of laid the foundation for Multics or the
the Multiplex information and computer servers at MIT, that
was led by Fernander Cobetto, he was one of the key members of
the CSS project.
And then they'll labs kind of funded the whole thing.
The uh DARPA was involved.
General Electric, Honeywell, uh.
So Multix kind of made advances in access controls, nammack
linking, processing demons and the kind of a focus on high
availability.
This was really be the first system to actually undergo a A
vulnerability assessment by the Air Force in 1973 and they came
up with the idea that it needed a security kernel.
So when 1969, the labs would drew from the project and then
umm, it kind of just faded away temporarily until Dennis Ritchie
and Ken Thompson, probably responsible for much of the
significant advances in computing during this period.
The uh.
They were contributors to the Multics project, so in 1969
Thompson's wife left for a summer vacation, and over the
next three weeks he wrote a research Unix.
Excuse me.
And.
Excuse me.
He basically programmed it for the laboratories and the goal
was to kind of make use of smaller scale PC at the time or
machines.
And one of the key components to the long surface success at Unix
was Thompson chose the design to operating system be relatively
easy to write code within.
That was the whole goal.
This kind of what makes the whole thing scalable.
The languages used to design Unix were mostly C and assembly,
but uh Thompson and Richie kind of used this prototype to
develop Unix with a team of engineers, and by the end of
1971, the 1st edition of Unix was released.
And then the second the following summer and.
Most of the modern standards for shale commands were kinda
established by the second release.
Thompson and Richie were able to establish for many of the
computing standards that are kind of still in practice today.
You could see all the stuff these guys did.
They're pretty amazing, kind of difficult to imagine how slowly
this would have evolved with that.
These two guys, we're kind of, uh, Ken Thompson was really big
on the idea of reading, creating things that are reusable by
other people.
So this is build joy.
He was an engineer that cofounded Sun Microsystems as a
graduate student who led the project to to develop Berkeley
Software Division, Unix, or Unix replica.
Based on the research Unix initially released in 1978 and
the folks at the VSD project was on open source coding and
unrestricted licensing permissions at the time Unix
was.
Owned in licensed by AT&T and had a whole bunch of
restrictions after the release of version 4.3 and 89, the
developers of BSD sedative establishment Code that was not
subject to the licensing agreement with AT&T.
So they came out with 4.3 BSD Reno in 1990 under the network
Release 1 license.
Excuse me, this is basically the beginning of all the BSD license
Unix replica distributions.
The let everybody to modify things and This is why
everything has all the same commands.
Umm, so there's another key figure, Richard Stallman.
He was a formal free software movement founder in 1983 with
the new project and response to the US Copyright Act of 1976.
The idea behind the movement was to kind of provide individuals
with unrestricted rights to freely use, study, modify and
distribute software licensed by the organization, and in 1989 he
founded the League of Programming Freedom to unify
independent software developers.
Stallman school was basically to create an open source Unix
replica and the system initially used for the that use the mock
kernel from Carnegie Mellon with a collection of utility tools
that were developed by the Free Software Foundation.
And they've used a whole bunch of kernels over the years.
He also provided someone that founding concepts of artificial
intelligence.
Umm, unfortunately he was kind of banished from the public
realm because he couldn't keep his mouth closed.
Uh, so the mascot for the new project is a wildebeest?
Or a new.
It's interesting because there are individually relatively
intelligent, unintelligent excuse me, but collective as a
group they're really efficient at surviving, and it's also a
recursive, infinitely recursive acronym for New, Not Unix.
If you guys been paying attention to the McDonald's
thing with the Mcflurry machine is kind of an example that
Stalin was trying to prevent the company tailor that makes the
machines for them actually design the machine to throw
fictitious air codes.
And there's a company called Kitch that solved the problem.
And then provided a solution and then tailor threatened Sue
everybody.
That's why nobody's Mcflurry machines work.
But there's a something going out.
There's every three years they reviewed the DMCA to make
exceptions, and that's on the ballot right now.
So Maurice Bach in 1986 released a book called The Design of the
Unix Operating System through AT&T Bell Laboratories.
This uh basically designed in detail the integral integral
components to Unix.
Excuse me?
One of his goals was to kind of provide programmers with the
reference manual to design Unix kernels, and this is mostly
sudocode and history, and it's kind of provided a lot of
insight to other people.
For other people, this is Andrews.
Tannenbaum.
He's got a ton of accolades as well.
In 1987, he released the 1st edition of MINIX, another Unix
replica, and the systems entirely designed for
educational purposes.
But it's now used for other things like Bach, Tenenbaum,
where the manual outlining the development of the process
called operating systems design and implementation.
Both of these books kind of serve as the guidelines for
operating system development and are used and tons of
universities.
O at Carnegie Mellon, this is where the mock kernel was
initially produced by a guy named Richard Rashid and Avi
Tevanian.
And it was part of a research experiment that started in 1985.
This is generally considered to be the first true micro kernel,
and the purpose of the project was to get a kernel for DSC Unix
and.
Kind of used started off with accent and a left kernels and
then kind of built from there.
So Rasheed ended up going on to develop or cofound Microsoft
Research with Gates and whatnot.
And there's 10s of thousands of patents that have been issued by
that company.
They those guys are incredible.
And to Bonnie and went on to work with Steve Jobs and Wozniak
to expand upon mock with the next step operating system.
When job stepped away from Apple for a little bit, that ended up
after he went back turning into the Mac OS and iOS systems.
And This is why all of your Mac machine still accept all the BSD
commands.
Though.
Everybody knows who Linus Torvald is.
These or should he developed Linux while he was studying at
as a computer science scientist?
Excuse me at the university at Belinsky, he basically purchased
a PC and it was designed to use for DOS.
He really didn't like DOS and he didn't like anything else he
could find.
So we started design a replica kernel so and he used box book
for the project.
He also went on to argue with Tannenbaum and a debate.
But, and so many of the features were kind of inherited from
mimics, the initial kernel was relatively limited, but after
sharing it with a whole bunch of other developers, it kind of
became a collaborative effort.
And in 1994, the first complete Linux kernel was released for
use under a GPL license.
And while there's still some limitations, the Linux kernel
was among the least likely to experience an operating system
crash.
And then big organizations started to adopt it to provide
infrastructural support for their organizations.
The the major hardware producers begin to design machine
specifically for Linux around this time, and this kind of
drove Torvalds to reissue the Linux kernel under GPL V2
license that allowed third party organizations to make
improvements to the kernel right of the modifications.
We're shared within the Linux community.
Eric S Raymond.
Kind of summarized the sentiment behind his plan.
Given enough eyeballs, all bugs are shallow.
Uh, what do you essentially done was create a global community of
developers dedicated toward a shared goal of perfecting an
open source Unix replica.
In 1997, he moved to the US to go work for Transmeta, who
designed X86 processors, and 2003 he left there to work with
open source development labs and then dedicate his time to
developing an Hants for the kernel.
And then OSDL merged with the Free Standards Group in 2007,
and that's where we got the Linux Foundation and we call it
Linux.
But it's really new Linux.
Fast forwarding to 2003 Unix replica systems account for
about 70% of operating systems globally.
The transition occurred despite, you know, a certain large
corporation to attempt to engineer and market a
proprietary alternative, and it's pretty clear the one.
I have to wonder what would have happened if one of these key
individuals was missing from the puzzle.
Umm, I don't know.
I'm.
I'm autistic myself and it's really interesting because I
think all these people were or are, and it's there.
There's a bunch of social outcasts that like built the
Internet and gave everybody cell phones and stuff.
It's pretty amazing.
I think that's all I have to share.
Have tons of whoops.
References that I looked up for this one.
I actually use Wikipedia.
I hope that isn't against the rules.
Great job.
No, that was was pretty cool.
And they know anything about all these people.
Is I'm not paying attention to the discovery guys, just kind of
paying attention to what they make.
So when we're going to replace Windows with Linux.
Right.
What we kind of already have Windows caved in.
Microsoft did, and there's a Windows subsystem for Linux, so
you can use all the BSD commands on Windows now.
It's kind of part of the reason why they were offering free
systems for a while too.
Excellent.
Let me rename this.
Alright, don't see Caroline.
I will go ahead and pull up the one for Arturo.
This is recording so.
No, stop.
Don't talk.
Don't go yet.
And let me share my screen.
Alright.
Can you see the?
Presentations like a web and that's good.
Alright, awesome.
It started with this.
Hello everyone and thank you for joining this master class on the
importance of patch management and vulnerability scanning.
Before we dig into the details, let's take a moment to overview
what we will be covering today.
Firstly, we will introduce the concepts of patch management and
vulnerability scanning, defining what they are and discussing
their roles in cyber security.
Understanding these foundational elements is crucial as they form
the backbone of our discussion.
Next, we will explore why Patch management is so important.
We'll look at how it helps in preventing the exploitation of
vulnerabilities, ensuring system stability and reliability, and
maintaining compliance with various regulations and
standards.
Following that, we'll discuss the significance of
vulnerability scanning.
We'll understand how it aids in identifying and assessing
security risks, prioritizing remediation efforts and ensuring
compliance with security policies and regulations.
After that, after we have a firm grasp on the importance of both,
will examine the relationship between patch management and
vulnerability scanning.
Will discuss how they complement each other and why integrating
both the both is essential and comprehensive cybersecurity
strategy.
Moving forward, we will delve into the best practices for
affective patch management and vulnerability scanning.
This section will provide you with actionable insights and
strategies to enhance your organization's cybersecurity
posture.
Finally, we'll conclude by summarizing the key points
discussed and reflecting on the critical role of patch
management and vulnerability scanning in cyber security.
I hope this session will provide you with valuable insight and a
deeper understanding of the subject.
Let's get started with the introduction to patch management
and vulnerability scanning.
Introduction to patch management and vulnerability scanning.
Definition of patch management.
Patch Management is an essential essential component in the
maintenance of computer systems, networks, and applications.
It's primary objective is to effectively handle the
installation of updates or patches for software
applications and technologies.
A patch refers to a software component that is specifically
created to enhance or rectify a computer program or its
associated data.
Its purpose is to address issues or enhance the functionality of
the program.
This includes the resolution of security vulnerabilities and
other software defects, as well as enhance the usability and
performance.
The process of patch management involves the following key
steps.
Identification identification is the first step in the patch
management process.
It involves regularly conducting vulnerability assessments to
scan the system and applications and identify vulnerabilities
that patches can address.
Maintaining communication with software vendors and subscribing
to alert services is also crucial to stay informed about
the latest patches available.
This step is foundational to understanding the patching needs
of an organization.
Next acquisition.
Once the need for a patch is identified, the acquisition
phase begins.
It is essential to verify the authenticity of patches to
ensure they are obtained from legitimate sources and avoid
introducing malicious software during this stage.
Patch prioritization is also crucial.
Organizations need to determine the urgency and importance of
applying each patch based on the severity of the vulnerabilities
addressed, which helps in allocating resources
effectively.
Next is testing.
Testing is a critical phase where compatibility checks are
performed to verify that patches do not conflict with existing
software and configurations and impact assessment is also
conducted to evaluate the potential impact of the patch on
system performance and functionality.
This steps helps in mitigating the risks associated with patch
deployment and ensures that the organizations operations are not
adversely affected.
Next deployment deployment involves planning and scheduling
the application of patches to minimize disruption to users and
services.
It also includes preparing rollback plans to revert the
patch if issues arise post deployment.
This phase is crucial for maintaining the stability of IT
systems and ensuring that security enhancements are
implemented effectively.
Next verification and reporting post deployment compliance
auditing is conducted to ensure that all systems adhere to the
organizations patch management policy.
Continuous performance monitoring is also essential to
detect any adverse effects of the patch and address them
promptly.
Verification and reporting are vital for maintaining
transparency and ensuring the ongoing effectiveness of the
patch management process.
Yes, next is documentation.
Documentation involves maintaining a comprehensive
patch inventory, including version numbers and installation
dates.
Any issues encountered during the patching process and the
steps taken to resolve them are also logged.
Proper documentation supports accountability and provides a
reference for future patching activities.
Definition of vulnerability scanning.
Vulnerability scanning is a comprehensive process used in
cyber security to identify, analyze and address
vulnerabilities present in a computer network or application.
The primary goal of vulnerability scanning is to
provide an organization with a clear view of potential security
risks, enabling them to prioritize and remediate these
vulnerabilities to enhance their overall security posture.
The process of vulnerability scanning typically involves the
following steps.
One scanning automated tools are used to scan network systems and
applications to identify potential vulnerabilities.
These tools compare the characteristics of the scan
items against a database based of known vulnerabilities.
Next assessment, once the scan is complete, the identify
vulnerabilities are assessed based on their potential impact,
exploitability and severity.
This assessment helps organizations prioritize which
vulnerabilities to address first.
Next reporting detailed reports are generated, generated,
outlining the vulnerabilities, discovered, their severity and
potential remediation steps.
These reports serve as a guide for IT teams to address the
identified vulnerabilities.
Next remediation based on the reports, organizations take the
necessary steps to fix or mitigate the vulnerabilities.
This could involve applying patches, changing
configurations, strengthen security policies or
implementing additional security measures.
And next is verification after remediation.
Additional scans are often conducted to verify that the
vulnerabilities had been effectively addressed and to
ensure that no new vulnerabilities have been
introduced in the process.
The role of both the role of both in cyber security.
Task management and vulnerability scanning
complement each other.
Vulnerability scanning identifies security gaps, while
patch management addresses those gaps.
Together they form a continuous cycle of identifying and
addressing vulnerabilities.
The integration of both practices enables organizations
to be proactive in their defense strategies by regularly
identifying and patching vulnerabilities, organizations
can stay ahead of cyber threats and mitigate the risk of
security incidents.
Implementing both patch management and vulnerability
scanning contributes to a holistic security posture,
ensuring that organizations are well equipped to defend against
evolving cyber threats.
And adapt to the changing cyber security landscape.
Why is pest management important?
Preventing exploitation of vulnerabilities?
Patch management plays a pivotal role in mitigation in mitigating
security risks by addressing vulnerabilities that could be
exploited by cybercriminals by applying by applying patches,
organizations can rectify security flaws, close potential
entry points, and bolster the security of their IT
infrastructure.
This proactive approach to defense enables organizations to
stay ahead of attackers by addressing known vulnerabilities
before they can be exploited, thereby reducing the likelihood
of successful cyber attacks.
The continuous process of identifying and and patching
vulnerabilities effectively reduces the organization's
attack surface, limiting opportunities for attackers to
infiltrate systems and compromise sensitive
information.
Ensuring systems stability and reliability beyond security
patch management is integral to maintaining the optimal
performance of systems and applications.
Patches often include fixes for bugs and enhancements that
improve software performance and user experience by ensuring that
systems and applications are regularly updated and patched,
organizations can avoid disruptions and maintain
operational excellence.
This is especially crucial for business critical applications
where downtime can have significant repercussions.
A stable and reliable IT environment facilitated by
regular patching enhances user experience, whether it be for
employers, employees accessing company resources, or customers
interacting with online services.
Compliance with regulations and standards compliance with
industry regulations and standards is another critical
aspect of patch management.
Various regulations such as PCI DSS for payment card information
and HIPAA for healthcare data mandate regularly passing to
safeguard sensitive information.
Meeting these regulatory requirements is essential to
avoid legal penalties, financial losses and reputational damage.
Organizations are often subject to audits to verify their
adherence.
To secure these standards and effective patch management is a
testament to their commitment to maintaining a secure
environment, demonstrating compliance.
Not only helps organizations pass audits, but also builds
trust with customers, partners, and stakeholders.
It signals a commitment to data protection and cyber security,
thereby enhancing the organization's reputation and
credibility in the market.
Why is vulnerability scanning important?
Identifying and assessing security risk vulnerability
scanning is a fundamental component of cybersecurity,
serving as the first line of defense and identifying and
assessing security risks by systematically scanning
networks, systems and applications, organizations can
uncover a my rate of vulnerabilities ranging from
outdated software to misconfigurations that identify
the identification of these vulnerabilities is crucial, as
it provides organizations with a clear picture of existing
security gaps and potential threats.
Assessing the severity and impact of these vulnerabilities
enables organizations to understand the level of risk
they pose to the organization's assets and data.
This comprehensive view of the security landscape is essential
for developing informed and effective strategies to mitigate
risk and enhance overall security.
Prioritizing remediation efforts once vulnerabilities are
identified and assessed, vulnerability scanning plays a
crucial role in prioritizing remediation efforts.
Organizations are often often face resource constraints and
must allocate their time and efforts effectively to address
the most critical vulnerabilities first.
Scanning provides detailed information about each
vulnerability, including its severity, exploitability and
potential impact on the organization.
By analyzing this information, organizations can prioritize
vulnerabilities based on risk, ensuring that the most
significant threats are addressed promptly.
This targeted approach to remediation is vital for
optimizing the use of resources, reducing the window of
opportunity for attackers, and minimizing the risk of security
incidents.
Compliance with security policies and regulations.
Vulnerability scanning is also indispensable for ensuring
compliance with security policies and regulations.
Many industry standards and regulation and regulatory
frameworks mandate regular vulnerability assessments to
safeguard sensitive information and maintain a secure IT
environment.
Conducting vulnerability scans helps organizations demonstrate
due diligence and adhering to these requirements and avoiding
legal and financial repercussions.
Additionally, vulnerability scanning supports the
development and enforcement of internal security policies by
identifying deviations and non compliance within the
organization, ensuring adherence to both external regulations and
internal policies is essential for maintaining a robust
security posture and fostering a culture of security, awareness
and responsibility.
The relationship between patch management and vulnerability
scanning, how they complement each other, patch management and
vulnerability scanning are two sides of the same coin, each
playing a pivotal role in maintaining a secure IT
environment.
Vulnerability scanning is the proactive detective measure that
identifies potential weaknesses in systems, networks and
applications.
It provides a comprehensive view of the vulnerabilities present,
allowing organizations to assess the associated risks.
On the other hand, patch management is the corrective
measure.
That event that addresses these identified vulnerabilities by
applying updates or fixes.
It acts on the insights provided by the vulnerability scanning to
remediate weaknesses and enhance system security.
In essence, vulnerability scanning uncovers the gaps and
patch management fills them.
This complementary relationship ensures that vulnerabilities are
not only identified, but also effectively addressed, thereby
forming a continuous cycle of security improvement.
Them the importance of integrating both in
cybersecurity strategy, integrating both patch
management and vulnerability scanning is crucial for
developing a holistic and effective cybersecurity
strategy.
The integration ensures that organizations are not only
reactive but also proactive in their approach to cybersecurity.
By regularly identifying and patching vulnerabilities,
organizations can stay ahead of potential threats, reduce the
attacks office, and mitigate the risk of exploitation by
malicious actors.
Therefore, furthermore, the integration of these practices
supports compliance with various industry regulations and
standards demonstrating an organization's commitment to
maintaining a secure environment.
It also aids in resource prioritization, ensuring that
the most critical vulnerabilities are addressed
promptly, thereby optimizing the use of resources and enhancing
overall security posture in a rapidly evolving threat
landscape.
The synergy between patch management and vulnerability
scanning is indispensable for building and maintaining
resilient IT infrastructure and safeguarding organizations,
assets and data.
Best practices for affective patch management and
vulnerability scanning.
Regularly scheduled scans and updates.
One of the foundational best practices is to conduct
regularly scheduled scans and updates.
Regular scanning of systems, networks and applications helps
in identifying vulnerabilities before they can be exploited by
malicious actors.
It improves organizations with up to date information on their
security posture and potential risks.
Similarly, scheduling regular updates and patches ensures that
identified vulnerabilities are promptly addressed, reducing the
window of opportunity for exploitation.
Adhering to a consistent schedule for scans and updates
helps in maintaining the security, stability, and
performance of IT environments and fosters a proactive approach
to cybersecurity.
Comprehensive coverage of systems and applications,
ensuring comprehensive coverage of all systems and applications
is paramount.
Every component of an organization's IT
infrastructure, including operating systems, software
applications, network devices, and even IO T devices can be a
potential entry point for cyber threats.
Therefore, it's essential that vulnerability scanning and patch
management encompasses the entire IT environment.
This comprehensive approach helps in identifying and
addressing vulnerabilities across the board, leaving no
stone unturned and no weakness.
No weak link in the security chain, it contributes to a
holistic security posture and mitigates the risk of overlooked
vulnerabilities, risk assessment and prioritization.
Once vulnerabilities are identified, conducting risk
assessment and prioritization is crucial.
Not all vulnerabilities pose the same level of risk, and
organizations must allocate their resources effectively to
address the most critical ones first.
Assessing the severity, exploitability, and potential
impact of each vulnerability helps in determining the level
of risk.
Based on the assessment, organizations can prioritize
remediation efforts, ensure that high risk vulnerabilities are
adjust promptly and appropriate measures are taken to mitigate
risk.
This targeted approach to remediation is essential for
optimizing resource utilization and enhancing overall security
testing and validation before deploying patches.
It's essential to conduct thorough testing and validation
testing patches in a controlled environment helps identify any
potential issues such as compatibility conflicts or
performance degradation before they are applied to live
systems.
This step is vital to avoid introducing new problems while
solving existing ones.
Once patches are deployed, validation is necessary to
ensure that they are correctly installed and effectively
addressed the vulnerabilities.
It also helps in verifying that no adverse effects have been
introduced in part in the patching process.
Testing and validation are critical steps in ensuring the
success of patch management and maintaining the reliability and
stability of IT systems.
Adhering to these best practices of regularly scheduled scans and
updates, comprehensive coverage risk assessment and
prioritization and thorough testing and validation
organizations can significantly enhance the effectiveness of
their patch management and vulnerability scanning process.
These practices are instrumental in building a resilient
cybersecurity infrastructure and safeguarding organizational
assets against evolving cyber threats.
As we wrap up, I'd like to go over a few essential points.
We've explored that is announced, vulnerability
scanning and patch management, and we know how important they
are individually and together to sum up, these procedures protect
US online, they find vulnerabilities, strengthen our
defenses and make sure our systems can withstand the
constantly shifting nature of cyber crime.
They're duty is both reactive and proactive, helping us to
prevent any security lapses from happening in the 1st place.
It is important to say enough about how important patch
management and vulnerability scanning are to security.
They are not just technical steps, they are strategic must
that protect our digital assets, keep up our public image and
ensure our stakeholders trust us.
Thank you for joining me on this interesting trip.
I hope you leave with a better understanding of these key parts
of security.
Does anybody have any questions?
OK, looks like we've got that.
Alright, looks like that.
No questions, OK.
And we don't have Caroline stop this.
OK well I have to say great presentation to Arturo as well
and everyone who has joined this evening.
Thank you for joining.
I appreciate you coming to the master classes for our interns
to present as they're needed every week and thank you so
much.
Excellent job for everybody.
Those that have not or will be presenting.
Check the schedule again so you know exactly what day you are
going to be presenting.
Seems to be a couple of mix ups so I wanna make sure that we get
everything straight because we have no open times.
So we want to make sure that everybody shows up.
Thank you everybody.
Have a great rest of the evening and a good weekend.
Have a good night.
Goodnight.