vid2cleantxt raw output transc - jonathan example 1

A is there some ole now ready it even grum so connection or do i anti sit conditions there a lot of areas hooking round. A apparently there are multiple people who have different opinions or let's say visions on how they should work in tai there is only one rule which is. Written and beta to will to follow that a connection from cloud to on re needs to go by alison a a a i a on established. And the amazon ids too much the sheet say the cloud and on prem zone for example if you go from a cloud a development it is to low too apr. Development and then to a on rent development so co nations like a cloud tet directly to a death or other is not. Lot and i any someone has an issue wit that takin the fatal a bush security strategic era picture boston or is in. Particular to have this or rule of rationalized because it is not as of now meaning we don't know how to you know how to assets how to. Review wat the a bank is it sir to be there no as not but a the one is tho the one you would approve for a brit out tat. Of a a i de yes note pocket take welcome good morning i anne girls. An old ladies in general in low a back to the there cor and i'm sorry i was outer yesterday so i don't know if you girls have dropped something to me i'm still to check my he mils but let's kit. And we gan touch pace if there's something in gene ned to discuss right away a so in general there are a couple of a topics that ave been worked upon in the team that i want to share with everyone one as. Bout the wolf project and we were participating in a cool last week with some folks which didn't feel like externals but i think they re were a but they're working on a. Of so the new my of the reduced their target is to reduce all the sixteen hundred controls to five hundred controls or this is not an activity that is right now engaging second line so that's where it stands. A we were in a discussion to ask questions of of their approaching it we had our concerns we shared it with them and gave our feet back on how they should be proceeding and. Also shared our experience on how we tried to reduce the anal effort by putting in the gist use and reducing a roman al effort in obtaining the assess ties in the risk assessment during the assessment. And we also tried to explain it to them how they could use the cheese question tagging to the control to see something that's not a a redundant but the scary parts that. They some of the controls that we discussed with them a they found those controls to be redundant because they didn't understand the perspective in which the control is being requested as i'm sure every one understands. That no one who has worked on the is a and in sequence for the controls published in the is a would understand what's the a perspective in which the qua the control is asking for in. Nation so based on the discussion on some of the controls we discuss we were able to point out that these are not redundant curve questions or controls but are asking for a different information from the other one that they find a it to be sane. Kind of looks cary at the by a for the moment i i don't know if the second line with the endorse the new my of the reduced one but for us for now it's not changing so we will continue with the same brisk assessment. Tool and with the same control set i think if this change comes into execution it will come in with the evolved project if we find lisa tool ever that gould do what we're already doing with such a. Precision let me put it this way that's one of the discussions we were part of i'm also now involved in a discussing how the cloud assets need to be invented it's still up. A in the air there's no final or no finite solution in place that would be able to put a cloud assets into the inventory right now have you also found that there is no pass as in. Uniquely registered in the asset inventory and so there are no planned risk assessments as well which i think briefly discussed a couple of weeks ago in the last june fix as well that how we need to have pass assets registered so that we have. Overage the example was a co billing is assessment that i have in which or it's a commercial of the self application running on a pas solution by work and there is no risk assessment done for pats to also. Things like pass as said saint claud needs to be identified and or only then can we have a coverage but still it's still on going i am in discussion with amelia who's running this as a project and julian wing an. So hendrix has asked us to involve in these discussions and i will keep your gaze posted how that progresses because latina and fajita a maria we will be looking at or a more so. As new assets will be registered under pas as well in incoming future of you remember last time a boston mentioned that a bath could pass assets are somehow registered already in sames. And do you know or that you can only buy nothing from them at the moment picker i'll tell you what it's also the show who said that a hundred per cent of on premise register so i would not take. Thing as they say it a but as long as it's if we can check again but i you also try to find it remember we were trying to find these assets together in a call and we couldn't find any. So everything they say i would not take it on the face value there min be a some segments i afar i fond for one thing no longer be miser limousin may scream sure can it be this of pas. Time right it will just be a dey of yer be zero pretax so you see. The talent is if if the behalf coverage possess because they are registered as the ideas you can risk assess them you have coverage for introspect or as a service as well because when you register or when. To enter any cloud service provider they are being discussed used as inter structure as a service and we check this a as well and there are planned risk assessments for them what is missing is the path risk assessment the example i gave a. A because i was looking at i copying like a set and in i co pilling there's a pass component but it's not even registered so there is no plan to so assessment so at the end i had to finally get a risk created a during the assessment a good thing is robert. Chief is doing the assessment on the other side and or he understood that there is a gap for their platform not registered as an asset and needs to be risk send separately so that's another asset aspect but we do not have a finite a or a final slut. Of how these pas assets needs to be registered and if it's one dis assessment that needs to be get de done a done by its to because all the assets are converted into one contract. For big and that is to be owned by tic too office and the it city prod claims of the risk assessment that would be happening i am at the moment believing that it's going to be done by its to as a product like. So pass and in respecter as a service are the two types of dis assessment that would happen that should happen on it city it's still not fine lace but that's the discussion that still needed to be happening a and or. Those were the two key topics i wanted to discuss i want to open up the call for reviewers a if or you want to bring out something or any one if you have any new topic before we move to the us hat one question regard. A parcel i an dis is or part of a day change your quest trade hospital am lecturer is there any change be require at than me to a request or. He meeting german at to change request fora sam restaurant to provide or appliances and whatever is missing and in that document its a. Ion that according to sim exclaim its plan to be included tee cor the type of stars besides we say we ned to obtain no no no not nothing for you to obtain the change. Because as farina showed you have a pass type type defined so there is an asset category there but there are no assets in sight so the challenge is first we need to get the assets registered in the asset infantry and if you're already up. A the act type as passer with the came to rap change than it will it should automatically by design pick up those assets as well right or is there something that i mae no no answered saudi. Us pas with data but an insert us not implemented and they may be close the take to posse just crated the the container for the depends data but no data in it. A then the question is we need make to extend the change of quest one that ask as well i should implement the change on the data type rather than on the data incite. If it in the change should be future proof there should be a looking for data inside the act type pass and if they don't have any it should reflect zero but whenever there is any because the change should be if there are new. Dates being made into pas type right now at zero and to morrow it could be ten assets in the pas type in pm is but day after to morrow it could be eleven or nine so the change should be implemented as such that it should always be actively looking for new asset types. Or or noe the aced types but the new sets being added into already defined type so if past type is already a part of the change then i del it should always look for the sets inside past me and if it has one it should report. It doesn't so i that's how the change should be i i is that not how it is implemented they wore not implement it because there is no data so site a loss a per fitly mentioned a. How to get the past car prominently invented that the just pars should be there that's what they have written as a type not in same mise yet a according to be avesta plan to be included. Be only no madison about pass i believe the gap is and also maybe scion is not hundred per cent missing the point when he says that they have implemented a sold. On for pass type because there is a defined pass type of act in mass so the entry is there the filters are set up the schemer is there what is not there is there is no data enter that's not shows job so when you're on boarding a. A set that's when you have to i believe the on working processes that when you're on wearing a new asset that's whet you have to either manually update the in inventory or i is a scan that puts the date a but i don't think that is happening for as to. That's where the solution is hundred not hundred per cent thar and that's where era what i was telling before is we brought into he discussion of how to fix the ascertainment by configuration items for a cloud assets that's where the a. So i think scion could say that they have done their job they've defined a category in which the acts would come in from cloud however there are there is no data inside it as merida assure so it's half and half solution right. No but i believe with as these cols progress in i would keep you up tacit wat the progress they're making in how they are going to invent ate from if if just to roll the ball out there for understanding how the risk assessments would look like in the future. From my perspective if it's one cloud then infrastructure as a service and past don't need ten dis assessments for ten products if it's all concentrated under one contract under it a to one dis assessment done for to per a us a. Ashore and rework for example these are the four by dor wit the head are four pas service poets that we are already using having one this assessment conducted for all four foreign fra streets a service and for platforms a service. Suffices brisk assessments for all products using them even a idea is not needed then a for asst no like an application us assessment see an application this assessment is needed. The some continent so her this is how it should function so baits again may we are back to let say i tan number of risk assessments no but they may daily is assessments are still there but where they on to go a a. No non currently there are no a different folk a grouts and a eight they are only king one proud yes be so when they do clouds they do think def. Rhetoric assessment them of is for the interest fan ton there is no assessment done on the id the a i a is the application running on it length we did as its this is no different from how you do for a on promos assessment high. You consolidated the out be a mess risk assessment because they are shared infrastructure and shared in frustration in the sense they run on a single base line so any one who uses it uses it the way or with the base line and its scanned and what not the same thing up. Be for the inference tractors the service and platform is a service they both work under a contract signed between debt and the cloud provider so they're just a layer on which you re on top of which you're installing your application so when you do a risk assessment. Or a id som asset it's running on top of these platforms so you do the assessment for the a id let's say commercial of the shelf so you do them of you use is for the a id and the basilisk assessment is for the platform company. So if there are any questions that are relating to platform a or or let's say in pass you have till dada isle wait so if there are questions when you're doing a out risk assessment in the risk assessments relating to. A the data base how it's managed or how the infra actor is being managed in a past solution you can refer to the risk assessment governor risk assortment what that does is we might in future look. To a possibility for pas specific or assets that them of could be a reduced one because there is only a certain number of controls on which i and because this is club there is only a very limited. Number of controls that you can actually make changes to the acton and not entirely so this is a valid point that we could in future reduce the let say court solution self developed application solutions that are using past. But as of right now those risk assessments go as they're planned any asset running on pas or in france chest service gets risk assess like they were running on prime but a bit of. Pas risk assessment one in fri structures or service risk assessment for all service powders they are who coo up by participating or who a predict support for if respect azov in in platform is a service and you don't have to risk assess. Very a set for those sets and celia understood a that paint i understood to can i just share my screen to explain what i mean so what you are saying is that for this a eighty they should be separate is a. Assessment which is exactly the amazon clad la platform there just they have just register this essay of but what ais as i ten it's underlying of of part acknowledging. You saying that they have to risk associating three hundred ninety separately and or tissue eld separately because i think that the the required there was a requirement to. Not requirement but they had to register it as aide because because of the unbecoming colts or something but it's actual and infra structure not sea application because their risk. Sensing it as an infra natural service and a not others possessing it as a application eris caressing it as deity three hundred ninety via awes yes yes as right so eros that what i was saying before. So they are right now for all or cloth service providers risk because they have registered it as an idea and they're doing a risk assessment on infra caches service my of let's put it this way they're missing a pass assessment this nee. To be fixed an swell as casper it is clear but is the how or how correct is to have two different ideas for the same said an this is what means to be fixed that's what i was saying that the. Of they need to be inventory is what is missing right now what i'm saying is that we need to have from technical requirements from our perspective we need to have two risk assessments how in we in entreat is title for this a year quote. Oke understood i understood understood no no question anna siree this is what the confusing part is that there is no right way to fined at the moment that hotel de klaus asset should be retread and that's. It's confusing that from from technical requirements it's two assessments but how they inventory get we need to still figure it up that's what is missing cen jus sequence questions a add does it stand. Or acetic or for application edit go question a data or a anyway i a canon claim a me i position lades application not assets i. Oke any questions on this discussion case kit kali there's a planet from the monterey return. Going at the chan a a thalia answered al renames lawyers in shaded and sponsored by our head of section. Inches isadora the answer asked elev itch us al right a end enforce use mon hel hazards who initiated. Sponsor teens my fate wolfram admits that the initial discussion so trusted to kit the speak as a mole day a lot of discussions order the supply security a. They wanted to twig them of but it's the same discussion you and i had a just early in the morning about how that is now we were participating in a quark when in they want to reduce them of by one third the sixteen hundred control. Should come down to five hundred and among those five hundred they get distributed into different ace types and that's the discussion a so mantras asking who initiated that my of change poker well echo welcome. Look here then moving on a revenues any key questions or points you want to discuss about risk assessments that are happening any feet pack that you require or then if not the cuts. Floor is open because we just have seven more minutes left a actually of last week we had of few points we are were trying to touch and a maybe. Need more brown sterling from your sight as well so a i donn like me to mean its from last time a first of all oliver a had a. That issue isn't creeps an oliver are you here oka so here of face sometimes or. Preparatory inscription in so and question was or if we or shout or accept it there is some of cases where it could. Approved by caesar group security or something like this or we should just go streaked with a duchy bursa cry i guide line and also i a recall that. Alexis font or smear answer in crypt aga lyon shook or if he can go detail is is question as well a i watt it i. Linens be thanks jena a when noting nothing major i did her i just a rejected in the crystal guide line and found a statement about the proprietary cry to and or protocols and what should. Done an sit a there desire if here acceptable or not a it's a it's a very generic statement but at least i quilted him the the batt of the gale lane that answers his question yet i think olive. Was sick a last week and see he didn't have the chance to come back to me yet on that am but i can share a i can share my screen now if you want to see what i quit it to him may be if you wont to use the time. To discuss it she let's go solvers a dedicated a paragraph in the cry toga. Lane a stating the providers of first to use a soft war for self contained inscription a containerized application where he climate generating online pics to manage to use keys it center and the different crater a. We had to check a well that that makes a proprietary trip to a accept a barrel would be that de solution meets the requirement of debug for deb i approved cryptographic measures so do general wants oulu using so. Number of bits of the keys it center a master buteo custom i are under the control of the big second tim and it is confirmed with the dip chi clod tim and or dib i second tim wither the appropriate bring your own key. Ken ism is in place prior using the cloud if it's relevant to a close solution so just wanted to know if it answers this point or if if he needed us to to check a bit more about that i don't know if you gaze at al other ideas will read to proprietary. Cryptography the challenges for alexis the challenger with the point a is that every cloud has their own cryptography a solution in christian be solution and i was having. Discussion with the julian wing an on this statement and a parses very let me put from his understanding this should not be a condition mind see. And i think hinduism relish was the one who reached out to me last week asking for the same information about bring your own key mechanism that proud should allow us a then but the challenges that clouds responders do not. Line with the statement and that's a problem so statement a is not entirely something that's used in the industry as it is documented here it's not possible in a way but at. Up in the cryptography guidelines of all these points they're entirely relevant to the question i can now read in the meting minutes so let's wait for oliver to come back because this might be an assessment that he's doing which has al. Any ended up with henri and i have responded to them so that it has no not come back to me again so i would count it as close because this was friday last to last week before the last turnover cub. But i think let oliver come back on this question if anyone else has a question then we can discuss more won or i think we are run enough time or and a. Previous meting minutes there was also few a poems alexis a gained hour amer part a prom a said owners and so on so next time we can also. Of timelessness sure i sent her an invitation now for thirty minutes it sadistic to discuss this point a bit of lynn and the be able to come back to the to the to fix a we've lets say a a. A but a but of a dancer already because this was a bitter a bitter ink me he a we just a minute away a so let me ask again any open issues. Anyone everything seems to be running smoke efren silence good an. Don't know where disguise i feel if you need something just reach out to me or anyone who can help but or feel free to reach out a report may i just still few seconds sure a yesterday we had really struggling miss rich. Target and i wanted to say every once that job been performed last twenty four hours is just amazing ticket were just like flying to our pocket and i'm so extremely grateful to every contribution you aids. Yesterday because of end previous week or because of seems like we're inch in target right now we do not have exact numbers a you really target right not the false target that disguise. Or you said that we've not yet given you all this hap real target local you know tut that that the i remember or discussion last week we were impacted by the wrong reporting somehow yes like real tar. Get which wee a ned to reach now and so on a and i just wanted to say thank you everyone and rosa air a been performed yesterday and last week is just amazing and delivery worst so. Above the line nos that i wanted to hi light it thank your lord hers to death hers too bad well then we are over a minute thank you a. So every one for give me morning time and a leach out if you need some thing thank your glad of it i stay