►
From YouTube: Lives On the Line. Learning Disaster Response From the Coronavirus Pandemic - Kris Nova
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2021 Virtual from May 4–7, 2021. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Lives On the Line. Learning Disaster Response From the Coronavirus Pandemic - Kris Nova & Dr. Rachel Beda, Wisepatient
Join us for an exciting session where two worlds collide to bring a deep look at disaster response in cloud-native from the lense of a global viral pandemic. Two unsuspecting women will grace the stage to share a powerful lesson. Join a practicing MD from Seattle, and a security expert from San Francisco as they look at the top lessons learned in the global response to the CoVID-19 Pandemic. They draw stark comparison to the incident response, detection, and disaster recovery in the medical field that with the same issues we see in software. Learn how open source was able to save lives. Learn how tools like Falco are used identically to the response field testing we saw during the outbreak. Learn how the world has taught itself to expect the unexpected, and respond to catastrophe. The audience walks away feeling secure and prepared for an unexpected disaster in their infrastructure.
https://sched.co/ekEA
A
Hello
and
welcome-
I
am
your
host
chris
nova,
and
I
am
here
with
my
good
friend
dr
rachel
vita,
and
we're
going
to
be
doing
our
presentation
today.
For
you,
this
is
called
lives
on
the
line
disaster
response
from
the
covet
19
pandemic,
so
we're
going
to
be
talking
about
kovid
medicine,
the
medical
industry
and
how
that
corresponds
to
disaster
recovery
and
site,
reliability,
engineering
and
security
and
cloud
native
technologies.
A
B
All
right,
hello,
everyone,
dr
rachel
bida,
I'm
an
internal
medicine,
physician
trained
at
university
of
washington.
I
am
not
kubernetes
informed.
I
am
merely
kubernetes
adjacent
thanks
to
my
spouse,
joe
bida.
That's
how
I
met
the
lovely
chris
nova
and
this
picture
you're
looking
at
here
is
one
of
the
places
I
have
been
the
most
scared
in
my
entire
life.
It's
the
roman
wall
below
the
summit
of
mount
baker
and
chris
coaxed
me
up
like
the
mama
bear
that
she
is
so
that
I
could
get
to
the
summit
and
not
die.
B
A
Awesome
and
hi
everyone
again,
I'm
chris
nova.
I
don't
even
know
what
to
say
right
now:
computer
science,
hacker
author
engineer,
troublemaker,
professional
public
speaker
when
there
used
to
be
a
public
now
I
think
we
cross
out
the
public
and
I'm
just
a
professional
speaker,
or
at
least
I
was
at
the
time
of
recording
this
I
like
to
climb
mountains
and
I'm
pumped
to
be
talking
about
medicine
and
mountain,
climbing
and
computer
science
and
security
and
site
reliability.
Engineering
today.
So
welcome
to
our
presentation.
A
I
started
to
think
about
how
a
lot
of
things
that
I
was
texting
rachel
about
were
very
similar
to
the
same
things
I
do
in
my
day,
job
which
is
site,
reliability,
engineering,
computer
science
and
can
software
security
and
distributed
systems.
As
I
we
started
to
explore
this
more
and
more
together,
we
discovered
there
was
a
lot
of
similarity
between
the
two
and
as
a
way
to
teach
folks
about
both
the
pandemic
and
computer
science
and
what
would
otherwise
be
a
pretty
scary
realm
of
things.
A
We're
going
to
be
drawing
some
parallels
between
the
two
of
these
and
and
how
they're,
similar
and
and
how
they're
different,
so
what
we
have
together
today
for
you
is.
We
have
four
main
categories
that
I
think
we're
going
to
kind
of
talk
through
and
we'll
we'll
elaborate
on
each
one
of
these
as
we
go,
and
we've
broken
each
of
these
four
main
categories
down
into
just
smaller
subcategories
we're
going
to
go
over
we're
going
to
kind
of
take
a
breath.
First
approach
at
describing
this
we'll
talk
about
the
outbreak.
A
What
that
meant-
and
in
this
analogy
the
outbreak
is
going
to
be
some
sort
of
technical
event.
You
know
something
happened
that
we
weren't
expecting,
whether
it's
a
computer
system
being
infected
with
a
virus
or
some
sort
of
catastrophic
production
outage.
We'll
talk
about
the
alarm
and
what
that
looks
like,
and
the
warning
signs
associated
with
that
we're
going
to
talk
about
the
the
response.
How
does
one
respond
to
these
types
of
things?
A
Talk
about
the
importance
of
quarantine,
what
that
means
from
a
viral
perspective
and
what
that
means
in
the
the
name
of
kubernetes,
we
talk
about
information
sharing
and
probably
more
important
misinformation
sharing
further.
We,
we
evaluate
our
response.
We
talk
about
two
concepts
that
are
both
important
in
security,
prevention
and
detection,
which
are
equally
as
important
in
the
medical
field
and
then
we're
going
to
go
into
finally,
the
the
future.
A
So,
let's,
let's
jump
right
into
it,
and
I'm
going
to
kind
of
be
picking
on
rachel
here
and
interviewing
her
and
asking
the
hard
questions
and
she'll
be
able
to
help
us
out
here
a
little
bit.
So,
let's,
let's
start
off,
we
have
we
have
the
outbreak,
it
happened,
there's
some
sort
of
incident
and
let's,
let's
kind
of
walk
through
what
this
was
like
for
you,
as
as
a
doctor
and
and
you're
based
out
of
seattle
right
rachel.
Yes,.
B
B
It
seemed
to
have
a
higher
death
rate
than
a
typical
respiratory
virus,
and
then
a
couple
of
weeks
after
we
started
to
understand
a
little
bit
more
about
it.
There
was
actually
a
big
holiday
in
china
chinese
new
year,
where
families
typically
get
together
and
travel,
and
that
was
sort
of
the
catalyst
for
a
lot
more
spread
very
quickly.
So
we
started
to
hear
about
this
in
seattle.
You
know,
of
course,
it's
it's
tempting
to
be
isolationist
and
think.
B
B
I
mean
you
know
I
was
probably
scrolling
twitter,
but
we
started
to
talk
about
it
in
the
clinic
and
my
practice
partner,
and
I
wanted
to
be
pretty
proactive
about
this.
Like
you
know,
okay
patients
are
going
to
call
us.
We
have.
We
have
smart
patients,
we
have
informed
patients,
they're
going
to
say
well,
we
have
patients
that
travel
a
lot
they're
going
to
be
calling
us.
So
what
is
going
to
be
our
response?
What
do
we
need
to
do
in
our
clinic?
B
A
Awesome
awesome,
so
the
parallel
that
we're
going
to
draw
here
is
we're
going
to
start
looking
at
what
that
would
feel
like,
as
it
relates
to
some
sort
of
cloud
native
system.
So
so
in
this
world.
When
I
say
cloud
native,
I
mean
some
sort
of
computer
system
running
kubernetes
with
a
handful
of
applications
running
on
top
of
it.
A
Something
goes
wrong
in
your
system,
whether
in
rachel's
case
she
was
reading
on
twitter
and
in
our
case
we
would
probably
start
to
see
some
sort
of
thing
starting
to
pop
up
in
in
some
other
systems.
So
this
is
a
good,
a
good
opportunity
to
share
the
lesson
of
observability
and
what
we
mean
when
we
say
observability
is
your
ability
to
understand,
what's
happening
at
the
the
system,
layer
and,
more
importantly,
to
connect
all
of
the
different
components
of
the
system
together.
A
In
other
words,
in
this
example,
we
have
a
physical,
we
have
system
and
we
have
applications
starting
from
the
bottom
up
and
in
the
physical
part
of
our
system.
These
are
things
like
compute,
storage
and
network.
This
is
the
the
linux
layer,
the
physical
layer,
something
you
could
go
and
touch,
and
really
what
kubernetes
does
is
it
does
a
good
job
at
orchestrating
this
physical
layer
for
us,
and
so
observability
would
be
our
ability
to
be
able
to
detect
when
something
in
that
layer
of
the
system
starts
to
go
wrong.
A
So
this
is
where
we
get
into
tools
like
prometheus
and
later
we're
going
to
get
into
more
advanced
runtime
security
tools
like
falcom.
We
move
into
the
system
and
that's
going
to
be
in
everything
from
kernel
tracing
to
operating
system
logs
to
operating
system
introspection
and
we're
going
to
be
able
to
start
to
map
those
together
and
that's
where
we
get
into
these
high
cardinality
observability
tools
that
you
see
around
the
ecosystem.
A
And
last
but
not
least,
we
have
application
instrumentation,
which
is
a
fancy
way
of
saying
glorified
logs.
In
my
mind,
you're,
actually
putting
lines
of
code
into
your
application
that
can
then
be
scooped
up
with
tools
like
prometheus,
such
that
you
and
your
team
can
know
about
it.
So
once
you
have
this
observability
system
in
place,
what
is
that
actually
going
to
look
like
for
you?
The
first
time
you
see
something
like
a
pandemic
breaking
out
in
a
computer
system?
A
It's
probably
just
going
to
look
like
a
little
blip
in
a
graph
and
that
little
blip
might
be
something
like.
Perhaps
one
of
your
pods
in
your
kubernetes
cluster
ran
out
of
memory,
or
perhaps
we
started
to
detect
system
calls
being
executed
that
have
never
been
executed
before
with
falco
and,
as
you
start
to
observe
these,
hence
the
term
observability
you're
going
to
start
to
have
the
initial
warning
signs
of
what
could
potentially
be
an
outage
or
some
sort
of
threat
moving
downstream.
A
A
B
Yeah
I
heard
I
heard
reports
that
there
were
two
people
that
had
coronavirus
in
washington
state.
We
were
pretty
much
the
very
first
hot
spot,
not
the
biggest
luckily,
but
one
of
the
probably
the
first,
and
there
were
two
cases
they
were
both
in
the
county
north
of
here
snohomish
county.
So
of
course
you're
like
well,
that's
not
my
county.
It's
not
going
to
affect
me,
and
you
know
you
try
to
reassure
yourself.
Well,
these
people
had
actually
come
back
from
china.
B
They
were
traveling,
you
know
so
clearly
it's
not
spreading
from
person
to
person
in
washington
like
it's
still
going
to
be
okay,
you
know,
there's
all
this
rationalization,
everybody
tries
to
do,
but
then
we
had
nursing
home
cases
at
life
care
center
in
kirkland,
which
is
you
know,
probably
15
minutes
from
here,
and
that
was
all
over
the
news.
I'm
sure
you
probably
all
remember
hearing
about
it,
but
it
was
spreading
from
person
to
person
in
a
nursing
home
here
in
king
county.
So
you
can't
ignore
it.
B
You
can't
pretend
it's
not
going
to
happen
like
it's
here.
It's
spreading
people
started
dying
and
then,
very
shortly
after
that
this
was
in
the
beginning
of
march
governor
james
lee
closed
this
close
the
schools.
Well,
seattle
closes
schools,
governor
janslee
had
a
quarantine
initiated
and
we
are
still
all
started.
Realizing
like
this
is
here.
This
is
scary.
It's
not
going
to
go
away,
and
so
rapid
intervention
was
made
in
western
washington.
A
Rapid
intervention-
oh
my
gosh-
I
love
it
so
relevant.
That's
that's
exactly
what
we
want
to
see
in
in
sort
of
a
cloud
native
system
right.
If
something
happens
and-
and
you
have
some
sort
of
alarm
and
in
the
case
of
rachel
it
was
you
know
the
governor
signing
the
alarm,
closing
schools,
people
dying,
you
want
to
be
able
to
do
something.
So
in
the
case
of
doing
any
sort
of
forensics
after
an
incident
in
computer
science,
the
first
thing
you're
wanna
gonna
do
is
you're.
A
A
So
an
alarm
could
come
from
everything
from
perhaps
a
metric
violation
in
prometheus.
But,
more
importantly,
we
look
at
falco
and
its
ability
to
trigger
a
runtime
alarm
when
something
unexpected
happens
in
your
kubernetes
cluster.
So
it'll
trigger
an
alarm,
and
you
can
respond
to
that
in
the
same
way
that
that
washington
state
responded
to
the
coronavirus
and
asked
people
to
quarantine
inside
in
the
case
of
falco.
A
If
you
trigger
an
alarm,
you
can
then
begin
to
quarantine
your
nodes
and
kubernetes,
and
you
can
begin
to
isolate
them
such
that
whatever
was
infecting
one
of
those
nodes.
You
can
make
sure
that
it's
no
longer
horizontally
spreading
to
to
other
nodes
in
the
cluster
and
alleviating
that
horizontal
attack
vector
that
you
would
see-
and
this
can
come
in
everything
in
the
form
of
outages
to
some
sort
of
malicious
behavior.
A
A
B
Oh
yeah,
definitely
definitely
I
remember
I
remember
having
well
you
get
used
to
your
page
you're,
going
off
at
all
hours
when
you're
an
intern,
and
you
have
no
control
over
your
life
to
the
point
where
now,
if
something
buzzes
on
me,
I
still
this
many
years
later
have
a
little
bit
of
that.
Oh
no
there's
my
pager
going
off,
even
though
I'm
not
wearing
a
pager
anymore,
so
yeah.
A
B
Yeah
so
so
you
know
everybody
remembers.
We
had
to
go
into
quarantine.
The
big
goal
with
quarantine,
of
course,
is
to
get
the
case
number
down
so
because
this
is
a
disease
that
is
spread
between
people
when
they
are
in
close
contact
person
to
person.
Primarily,
the
goal
is
to
have
people
stop
being
in
close
proximity
with
each
other
to
slow
the
spread.
I
mean,
there's
some
there's
some
fomite
spread
where
somebody
sneezes
on
a
door
handle
and
then
you
touch
the
door
handle.
B
But
honestly,
the
most,
the
biggest
way
that
coronavirus
is
spread
is
person-to-person,
inhaling
particles
that
somebody
coughed
saying
yelled
spit
out
of
their
mouth
into
the
air.
Next
to
you,
you
breathe
in
the
particles,
so
we
want
to
get
the
the
replication
number
down
below
one
so
to
explain
what
that
means,
so
the
r
naught
or
the
replication
number
of
a
disease
is
how
many
new
cases
you
get
from
one
infected
individual.
B
So
initially
we
thought
that
coronavirus
had
an
r
of
about
two
to
three
in
clusters
and
certain
areas
it
may
be
as
high
as
four
to
five,
but
we
want
that
value
down
below
one,
because
if
the
number
of
new
people
infected
from
a
current
case
is
less
than
one
the
disease
shrinks,
the
disease
will
eventually
go
away.
If
you
keep
that
r
below
one
different
diseases
have
different
infectious
abilities,
so
measles
is
one
of
the
most
incredibly
infectious
diseases.
B
Somebody
can
have
measles,
you
know
cough
or
sneeze
in
a
room,
and
there
are
still
measles
particles
circulating
around
in
that
room
hours
and
hours
later,
and
so
the
r
naught
for
measles
is
12
to
18.,
so
12
to
18
new
cases
of
measles
will
come
from
one
infected
person.
So
we,
a
lot
of
you,
know,
there's
a
lot
of
talk
early
on
in
march
of
like
getting
the
r
knot
below
one.
B
A
But
you
have
a
wonderful
set
of
tools
that
people
put
a
lot
of
time
into
effort,
making
it
convenient
for
you
to
access
other
nodes
in
the
cluster
as
well.
So
you
see
that
same
type
of
telescoping
nature
and
there's
some
type
of
curves
that
you
would
see
in
an
infection
spreading,
but
in
some
sort
of
a
horizontal
attack
vector
in
kubernetes
and
there's
a
handful
of
those
and
if
you're
interested
in
getting
involved,
please
reach
out.
A
We
can
connect
you
with
folks
in
stick
security
and
and
talk
about
how
you
can
get
involved
with
not
only
understanding
the
different
attack
vectors
in
the
potentially
known
cves,
but
how
you
can
prevent
them
moving
forward.
We
also
look
at
failure
rates
and
and
how
you
can
respond
to
them
with
things
like
cluster
api.
Perhaps
you,
you
notice
that
you
have
a
handful
of
nodes.
Some
of
them
have
been
compromised
and
you
want
to
grab
some
snapshots
of
them
and
and
take
them
down.
A
Cluster
api
would
be
able
to
give
you
a
set
of
tools
to
to
mitigate
that
and
to
mutate
those
nodes
at
runtime.
You
could
plug
that
into
the
rest
of
your
your
backup
system
and
that
would
actually
be
able
to
to
take
those
down
and
to
drain
the
nodes
and
to
get
whatever
infection
was
inside
of
your
kubernetes
cluster
offline,
such
that
you
could
bring
up
new
immutable
infrastructure
along
the
side
of
it
and
we're
back
and
my
camera
died.
But
yes,
network
isolation
is
going
to
be
a
big
part
of
quarantine.
A
If
you
can
alleviate
the
the
infection
or
the
malicious
user
at
the
network,
layer,
you're
gonna
drastically
diminish
their
ability
to
communicate
with
other
pieces
of
infrastructure
with
inside
of
your
your
computer
system.
So
again
we
we
see
that
quarantine
isn't
important
here,
but
but
more
important
than
that.
The
ability
to
to
take
action
and
to
understand
that,
once
you
have
one
potential
compromise
you
can,
you
can
see
that
spread
to
other
parts
of
your
infrastructure
as
well.
B
All
right,
so
with
the
coronavirus,
there
was
a
lot
of
information
coming
out
really
fast
and
there
was
some
misinformation.
Some
of
the
early
information
was
well-meaning
and
we
thought
it
was
probably
good
information,
but
it
was
sort
of
rushed
out
as
quickly
as
possible
without
being
peer,
reviewed
or
really
confirmed,
and
so
first,
let's
start
with
the
good.
The
good
stuff
was
the
chinese
government
and
the
chinese
medical
establishment
worked
incredibly
quickly.
B
They
had
so
the
first
big
government
report
of
the
coronavirus
being
an
actual
disease,
and
an
issue
is
about
december
31st
or
january
1st.
They
had
the
coronavirus
genome
sequenced
by
january
12th
that
is
mind-blowingly
fast
and
then
they
open
sourced
it.
They
put
out
the
coronavirus
genome
globally
and
said:
look
here's
what
we
found
and
that
allowed
everybody
to
get
started
on
potential
vaccines
that
much
faster.
B
So
that
was
awesome.
Ppe
protocols,
we
got
these
lovely
pdf
downloads
of
exactly
how
to
don
and
off
your
ppe.
What
ppe
was
required,
how
to
have
teams
how
to
have
an
observer?
How
to
they
also
had
some
a
lot
more
somber
things
about
how
to
take
care
of
patients
once
they
passed
away,
how
to
prevent
spreading
the
virus
from
a
deceased
patient.
B
All
of
this
was
open
sourced
and
passed
out
around
the
medical
community
around
the
world
and
undoubtedly
saved
a
lot
of
lives
by
our
chinese
colleagues
in
medicine.
Wanting
to
get
this
information
out
as
fast
as
possible,
there
were
mis.
There
was
a
lot
of
misinformation,
so
at
first
there
was
a
lot
of
talk
about.
Don't
worry
just
make
it
till
summer,
when
it's
warm,
it's
just
going
to
go
away.
Well
that
didn't
happen.
There
were
small
observational
studies.
B
There
was
a
lot
of
other
misinformation
about
different
medications.
There
was
the
there
was
the
week
where
we
all
were
too
afraid
to
take
nsaids.
There
was
the
week
where
hypertensive
patients
were
afraid
to
take
their
blood
pressure
medicine
because
of
ace
inhibitor
interaction
with
covid.
There
were.
There
was
misinformation
about
how
it
gets
transmitted
about
whether
you
know
if
your
delivery
person
delivers
you
an
amazon
package,
and
then
you
touch
the
package.
B
Are
you
gonna
die
of
coronavirus,
all
sorts
of
misinformation
on
the
internet,
and
so
it
was
hard
to
know
what
to
believe
and
what
was
going
to
change
a
week
from
now
and
what
kind
of
mask
works
and
what
kind
of
mask
doesn't.
And
then
there
were
people
saying,
don't
worry
it's
just
like
the
flu.
Only
people
who
have
a
lot
of
medical
conditions
will
actually
die
from
it,
which
was
both
horrible
to
say,
but
also
turned
out
to
be
wrong.
So
the
whole
thing
wound
up
with
everybody
in
a
state
of
panic.
A
A
So
a
huge
lesson
in
humanity
here
in
the
importance
of
sharing
information
as
as
needed.
After
this,
we
look
into
post-mortem
evaluation.
So
this
is
the
the
process,
the
ceremony
in
which
a
you'll
notice
that
a
lot
of
times
anyway,
we
were
talking
about
post-mortem
evaluation
and
what
that
means-
and
like
I
had
mentioned
it's
the
it's
the
exercise
of
getting
together
after
some
sort
of
event
and
trying
to
to
understand
what
happened.
It's
this
process
of
going
through
with
you
and
your
team.
Typically
you're,
not
assigning
blame.
A
It's
not
a
blameful
exercise,
you're,
just
trying
to
discover
what
happened
in
the
same
way.
We
see
this
with
with
the
covid,
it's
it's.
How
did
it
get
here?
How
do
we
respond
to
it?
And
and
what
do
we
do
to
prevent
it
from
happening
moving
forward?
And
so
other
misinformation,
you
might
see
as
you're,
going
through
a
system
is
be
aware
of
things
like
false
positives
and
red
herrings.
A
So
these
are
things
that
that
can
come
up
where
it
may
look
like
you're,
detecting
the
problem,
or
it
may
look
like
you're,
actually
understanding
what's
going
on,
but
the
the
truth
is.
If
anybody
here
has
ever
debugged
a
live
production
system
before
the
truth
is
typically
much
much
more
sinister
and
usually
involves
dns
anyway,
we're
looking
at
correlation
versus
causation.
B
A
Some
reason
why
your
pods
are
getting
them
killed
or
something
happening,
but
it
isn't
always
necessarily
the
right
thing,
and
sometimes
it's
easy
to
get
fooled
by
speculation,
to
think
that
you've
discovered
it
and
that
could
actually
end
up
causing
more
problems
downstream.
So
so
the
the
main
takeaway
here
from
a
computer
site,
reliability,
engineering
perspective,
is
just
to
be
skeptical
just
to
to
try
to
prove
that,
instead
of
trying
to
prove
things
right,
try
to
prove
them
not
wrong.
A
It's
a
good
rule
of
thumb
that
I
like
to
follow
so
moving
on
two
really
important
concepts
here
that
I
have
already
mentioned
once:
prevention
and
detection
and
the
the
differences
between
the
two
and
and
how
they're
both
relevant
both
medical
industry
as
well
as
computer
science.
One
way
I
like
to
look
at
this
is
security
policy
for
humans.
A
B
Like
that
nice
all
right
well,
so
we're
all
pretty
good
about
knowing
what
we
need
to
do
to
prevent
cobia
19.
At
this
point
I
mean
you've
all
heard
it
all
over
the
news.
Social
media
everywhere
so
masks
wash
your
hands
social
distance
thing.
But
let
me
go
back
to
masks
so
initially
we
thought
that
you
had
to
have
like
you
know:
full
moon
suit,
hazmat
n95
everything
to
prevent
it,
and
then
we
realized
no,
it's
split
spread
by
droplets.
B
So
you
know
cute
little
cloth
masks
that
your
auntie
makes
you
are
probably
good
enough
and
then
oh,
but
no
maybe
it
is
actually
aerosolized
and
airborne,
and
so
now
we've
gone
back
to
healthcare
providers,
and
anybody
that
is
dealing
with
somebody
who
potentially
has
coveted
or
is
known
to
have
coveted
needs
to
go
back
to
using
n95s
but
basically
masks.
Work
masks
decrease
the
spread.
We
now
know
that
it's
respiratory
spread
far
more
than
on
you
know
by
sneezing
on
a
doorknob
for
example.
So
you
know
wear
a
mask.
B
We
also
know
I
mean
washing
your
hands.
You
know
like
wash
your
hands.
We've
all
known
this
since
we're
little
kids
just
wash
your
hands
and
then
social
distancing.
So
if
we
stay
six
feet
apart
from
each
other,
but
you
know,
is
it
exactly
six
feet?
No,
it's
somewhere
around
six
feet
further
is
better.
Are
you
outside?
Are
there
air
currents
to
disperse
the
droplets
faster?
Do
you
are
you
somewhere
where
they
have
a
really
good
hepa
filter
and
also
we,
you
really
want
to
decrease
the
number
of
particles
you
inhale.
B
That's
another
reason
why
we
think
that
cloth
masks
are
helpful,
even
if
they
don't
keep
out.
You
know
a
hundred
percent
of
covered
particles,
because
there
seems
to
be
a
correlation
between
the
number
of
particles
you
inhale
and
how
sick
you
get.
So
it's
thought
that
people
who
inhale
a
whole
lot
of
covet
virons
get
a
lot
sicker
than
people
who
may
have
only
inhaled
a
few
again
we're
still
learning
about
this.
B
We're
still
learning
you
know,
monthly,
there's
new
information
coming
out,
so
just
because
we
said
one
thing
a
few
months
ago
and
now
we're
seeing
another,
I
mean:
that's
science,
that's
what's
good
about
science
with
more
evidence,
you
have
new
information
to
go
on,
so
it's
still
evolving
and
unfortunately,
unlike
other
diseases,
we
don't
have
a
preventive
medication.
Yet
we
don't
have
a
vaccine.
Yet
we
don't
have
a
way
to
really
prevent
it
from
that
standpoint,
so
we're
still
stuck
with
wear
a
mask,
wash
your
hands
and
still
keep
social
distancing.
A
I
mean
it's
literally,
a
one-to-one
relationship,
just
like
rachel
was
talking
about
so
the
first
thing
is:
is
role-based
access,
control,
access
control?
Who
can
do?
What
can
this
group
of
users
access
this
system?
Can
this
group
of
users
access
that
system
and
how
well
are
these
systems
defined?
How
many
parts
of
the
system
are
actually
lumped
into
this
access
control
and
that's
where
we
get
into
things
like
admissions
controller
which
allow
you
to
control
what
is
and
is
not
admitted
into
your
kubernetes
cluster?
A
Furthermore,
we
can
take
that
a
step
further
and
look
at
things
like
security
policy.
This
is
everything
from
pod
security
policy
to
oppa,
open
policy,
agent,
opa
and
other
concrete
implementations
like
gatekeeper,
so
you're,
starting
to
look
at
how
we're
expressing
what
people
can
and
can't
do
what
users
can
and
can't
do
what
clients
can
and
can't
do
inside
of
our
kubernetes
cluster
and
the
more
rigorous
our
security
policy
is
at
preventing
these
things
from
happening,
the
less
likely
it
is
that
our
cluster
is
gonna,
get
compromised
or
that
we're
gonna
get
sick.
A
So,
yes,
there
are
things
that
are
very,
very
identical
to
masks
like
they're,
not
foolproof,
like
if
you,
for
instance,
if
you
look
at
our
back,
if
you
run
a
privileged
container
in
our
bag
in
an
rbac
cluster,
where
you
only
have
access
to
a
given
namespace,
you
can
still
escalate
it
down
to
the
node,
compromising
the
entire
cluster
and
escalate
out
of
that
namespace.
But
it's
still
effective
for
people
who
don't
know
about
that
attack
factor
a
well-known
attack
factor,
that's
been
out
for
years.
A
So
again,
we're
in
that
we're
in
the
situation
where,
like
we're,
we're
just
trying
to
strengthen
our
preventative
techniques
in
order
to
minimize
the
amount
of
potential
compromise
we
see
downstream,
we
go
and
take
that
further
with
things
like
regression
testing.
How
do
we
prove
and
disprove
that
things
that
have
happened
in
our
cluster
that
we
didn't
want
to
happen
are
no
longer
happening
again.
We
take
that
a
step
further
with
things
like
kernel
controls.
How
do
we
control
which
processes
which
users
can
and
can't
execute?
Which
system
calls?
A
At
the
end
of
the
day,
all
applications
need
to
translate
to
the
kernel
somehow,
and
that's
where
things
like
glibc
come
into
play
that
ultimately
translate
directly
into
system
calls
and
if
we're
able
to
control
what
users
can
and
can't
execute
various
system
calls
we're
able
to
control
which
parts
of
our
cluster
and
parts
of
our
system
can
and
can't
get
sick.
So
we
see
this
all
throughout
the
ecosystem
and
it's
absolutely
critical
for
any
type
of
security
policy.
It's
just
like
washing
your
hands.
You've
got
to
wash
your
hands.
A
B
All
right,
testing
detection:
how
do
we
figure
out
who
has
coveted
early
to
prevent
more
spreading
so
in
medicine,
every
test
has
sensitivity,
sensitivity
and
specificity,
so
sensitivity
is
if
somebody
has
a
disease
and
you
test
them
for
it.
Do
you
actually
pick
it
up
and
then
specificity
is?
If
you
test
somebody
and
your
test
comes
back
positive,
do
they
actually
have
the
disease
or
is
it
a
false
positive?
So
it's
not
enough
for
a
test
to
be
really
sensitive,
but
not
specific,
or
vice
versa.
B
It
has
to
be
sensitive
and
specific
to
really
be
able
to
trust
your
results.
So
right
now
we
have
rapid
testing,
like
you
know,
point
of
care
testing
all
these.
Well
sports
teams,
politicians
they
keep
getting
tested
frequently
and
rapidly.
It
hasn't
really
been
rolled
out
to
the
general
population.
Yet,
unfortunately,
and
then
we
have
pcr-based
lab
control,
confirmatory
testing,
so
that's
the
swab
that
everybody
knows
about
that
goes
way
up
and
the
joke
is
its
brain
biopsy,
because
it
goes
so
far
back.
It
has
to
go
to
the
lab.
B
It
takes
hours
to
come
back
generally,
it's
functionally
you
get
your
result
in
a
day
or
two
I
mean
that's,
not
really
good
enough
to
really
be
able
to
quell
the
spread.
So
we
want
rapid
testing.
The
problem
is:
rapid
testing
is
not
as
sensitive
as
lab
confirmatory
pcr
testing.
So
the
question
is:
is
that?
A
After
you
get
done
talking,
because
these
analogies
are
just
writing
themselves,
we
see
this
exact
same
thing
in
in
kubernetes.
You
want
to
be
able
to
check
the
false
positives
and,
in
some
cases,
as
you're
debugging,
your
systems
from
a
site,
reliability,
engineering
perspective,
it's
just
about
getting
things
out
there
and
I
would
rather
have
you
know
if
I
have
a
thousand
nodes
in
my
cluster.
A
I
would
rather
know
that
90
of
them
are
up
and
running
and
healthy
than
know
that
none
of
them
are
up
and
running
and
healthy,
especially
if
that
90
of
them
that
are
healthy
comes
with
a
a
small
amount
of
uncertainty
right.
So
that's
where
we're
getting
into
like
the
computer
science
terms
of
being
having
a
false,
positive
or
proving
something
that
looks
like
it's.
It's
actually
not
working
when
all
in
actuality.
It
is
so.
A
Furthermore,
we
look
at
other
detection
primitives
like
falco,
I
mean
we
take
it
down
to
the
system
call
layer
and
if
you
want
to
come
in
and
see
what's
going
on
at
the
kernel,
falco
is
going
to
be
the
number
one
way
for
you
to
take
that
information
and
pull
it
up
into
user
space
so
that
you
can
start
detecting
runtime
security
anomalies
and
there's
already
a
complete
rule
set
defined
for
you,
so
that
you
can
actually
understand
what's
happening
out
there
for
testing.
Look
no
further
than
regression
testing.
A
You
can
write
a
regression
test
for
more
than
just
software
if
something
goes
into
your
system
and
violates
the
network
or
violates
the
kernel
or
violates
the
infrastructure
or
violates
your
storage,
you
can
write
a
regression
test
for
that.
If
you
have
a
good
infrastructure
testing
suite
set
up
and
running
so
again,
it's
just
about
knowing
what's
going
on
once
you
know
you're
able
to
make
decisions.
A
We
all
remember
what
it
was
like
at
the
beginning
of
quarantine
where
nobody
knew
what
was
going
on,
and
that
was
very
stressful
time
for
us
to
actually
make
any
concrete
plans
for
our
families,
because
we
didn't
know
what
was
going
on
so
in
computer
science.
Please
please,
please
understand
the
value
of
simply
being
able
to
say
if
something
is
true
or
false.
A
B
B
The
vaccine,
of
course
everybody
is
hoping
it
will
come
out
like
yesterday,
what
we're
going
to
need,
though,
once
we
have
a
vaccine,
we
need
a
vaccine,
that's
going
to
achieve
70
percent
immunity
and
where
that
number
comes
from
is
the
concept
of
herd
immunity.
We
need
the
vaccine
to
both
be
deployed
widely
enough,
that
everybody
can
get
it
or
at
least
about
94
percent
of
us
can
get
it,
and
then
we
need
that
vaccine
to
work
on
as
many
people
as
possible.
So
let's
take
an
example
of
a
vaccine.
B
B
It
turns
out
there's
a
certain
percentage
of
the
community
that
is
never
going
to
mount
a
response,
an
immune
response
to
to
whooping
cough,
no
matter
how
many
times
you
give
them
a
vaccine.
So
what
we
have
to
do
is
give
the
vaccine
to
94
at
least
of
the
population.
That's
the
target
so
that
those
people
who
never
mount
a
vaccine,
it
doesn't
really
matter
there,
aren't
enough
targets
for
the
disease
to
keep
spreading
throughout
the
community.
So
once
this
vaccine
comes
out,
we
still
aren't
going
to
be.
B
You
know
back
to
life
as
normal
until
enough
of
us
get
vaccinated,
that
70
percent
of
the
folks
in
the
world
really
are
immune,
so
that
means
either
70
percent
of
people
get
vaccinated
and
it
works
100
percent
of
the
time
or
100
percent
of
the
people
get
vaccinated
and
it
works.
70
percent
of
the
time
vaccine
phases
come
in
three
phases:
phase
one
and
two
are
basically
to
prove
that
number
one.
B
So
there
are
multiple
vaccine
candidates
that
have
gone
through
phase
one
and
phase
two,
and
we
have
several
now
that
are
into
phase
three,
which
is
where
we
start
vaccinating
thousands
of
people.
Volunteers.
Of
course,
thousands
of
people
well
in
the
us
there
are
volunteers
in
other
countries,
they've
taken
different
approaches
where
people
aren't
given
as
much
choice
of
whether
they
get
the
vaccine
or
not.
B
That's
going
to
take
a
while.
I
I'm
not
in
the
practice
of
predicting
the
future.
So
I
wish
I
could
tell
you
what
day,
what
month
it's
going
to
happen,
I
can't
but
things
are
moving
along
and
things
are
moving
along
a
lot
more
quickly
than
they
have
in
the
past
for
any
other
vaccine.
That
we've
tried
to
make.
A
All
right,
so,
let's
talk
about
patching
production
right,
so
this
is
the
analogous
of
this.
What
how
do
we?
How
do
we
cure
production
if
something
goes
wrong?
So
let's
say
that
there
was
a
malicious
user
that
violated
our
system
and
came
into
our
production
cluster
and
started
doing
something.
Let's
say
they
were
mining
for
bitcoin
and
we
wanted
to
go
and
fix
that.
Well,
the
first
thing
we're
going
to
do
is
we
have
to
stop
it
from
from
from
spreading
any
further.
A
So
this
is
a
way
of
effectively
introducing
a
new
change
into
our
system
that
will
that
will
prevent
this
malicious
user
for
coming
back
in
and
taking
some
sort
of
action
and
causing
harm
later.
So
how
we
do
that
is
we
typically
want
to
deploy
something,
whether
it's
a
patch
to
production,
a
new
container
image
or
a
new
artifact
for
our
application.
Perhaps
it's
not
even
has
nothing
to
do
with
our
application.
It's
part
of
the
the
software
we're
running
on
top
of
some
cases.
It
could
be
part
of
kubernetes
itself.
A
In
some
cases
it
could
be
part
of
linux
itself,
regardless.
We
want
to
make
sure
that
we
are
able
to
prove
beyond
the
shadow
of
a
doubt
that
this
is
in
fact
what
we
want
to
be
deploying
once
we
actually
deployed
to
production
and
that's
where
image,
providence
and
artifact
providence
comes
into
play,
proving
that
it
is
what
we
think
it
is
making
sure
that
we're
not
somehow
compromised
as
we're
trying
to
inject
the
new
fix
into
our
system.
A
If
there's
any
differences
to
see,
if
anything
has
gone
wrong
with
any
change,
and
that
allows
you
to
do
things
like
slowly
dial
into
the
new
system
so
that
you're
not
just
doing
a
cold
cut
over
and
compromising
every
piece
of
infrastructure
in
your
cluster
and
that's
where
partial
patching
comes
into
play,
just
you
could
start
off
with
10
moves
up
to
25,
50,
75,
80,
90
and
then
finally,
the
whole
thing's
cut
over
and
again
this
a
perfect
example
of
this
is
patching.
Ssl
right,
there's
a
vulnerability.
A
It
sits
in
every
piece
of
software
virtually
out
there
and
then
how
do
we
go
through?
And
how
do
we
begin
to
fix
that
across
the
the
board
for
us,
and
that
can
be
a
tedious
process
so
so
making
sure
that
you
have
a
good
story
in
place
for
how
you're
going
to
go
and
patch?
This
is
going
to
be
critical.
B
All
right
so
for
any
disaster,
you
have
to
have
a
response
plan
in
place
and
for
cova
19.
That's
really
been
super
challenging
this
year,
as
I'm
sure
everybody
is
fully
aware,
although
I
guess
it
depends
on
which
part
of
the
world
you
live
in,
but
in
the
united
states
there
was
a
pandemic
response
working
group
that
was
proposed
back
in
2016..
B
It
involved
scientists.
It
was
a
working
group
to
make
a
plan
because
it
was
apparent
that,
based
on
our
history,
there
is
going
to
be
a
pandemic
again.
At
some
point.
We
already
knew
about
ebola.
We
knew
about
sars.
The
first
time
around.
We
knew
about
the
global
flu
pandemic
back
in
1918
1919,
so
there
so,
the
in
2016
the
government
had
a
robust
plan.
B
This
has,
it,
unfortunately,
was
disregarded
and
not
put
into
place
in
the
united
states
when
it
was
actually
needed,
but
previously
there
had
been
a
plan,
but
this
is
a
good
example.
You
need
to
have
a
plan.
You
can't
just
wait
until
something
bad
happens
and
then
scramble
retroactively.
You
should
always
be
proactive
about
this
sort
of
stuff.
B
B
We
also
have
a
u.s
stockpile
of
critical
medications,
including
antibiotics
like,
for
example,
antibiotics
against
against
anthrax,
airway
and
breathing
medications,
things
that
are
absolutely
critical.
We
do
have
a
national
stockpile
of
that,
and
then
you
have
to
have
a
deployable
chain
of
command.
That
is,
you
know,
identified
in
advance
and
then
able
to
be
rapidly
deployed
a
phrase
I
used
earlier
rapid
deployment
of
pre-planned
scenarios
and
not
wait
retroactively
to
scramble
once
a
disaster
happens.
A
Beautiful
absolutely
couldn't
agree
enough.
This
is
the
first
thing
I
tell
people
when
I
walk
into
an
sre
team,
or
especially
a
new
sre
team
is
what
are
you
gonna
do
when
something
breaks?
What
are
you
gonna
do
when
you
know
it's
the
fan
and
and
that's
that's
a
real
conversation
that
a
lot
of
people
aren't
prepared
for
or
even
more
so
there's
this
like
this.
A
This
false
hope
that
we
are
prepared
for
it,
but
nobody
actually
knows
where
the
manual
is,
and
we
see
that
a
lot
a
lot
in
disaster
recovery
because
it's
you
know,
it's
never
gonna
happen
to
you
and
of
course,
until
it
does
so
being
prepared
is
a
huge
lesson.
Anytime,
you're,
looking
at
like
doing
any
sort
of
resilient
distributed
systems
engineering,
so
the
first
steps
to
recovering
a
system
you
have
to
roll
back.
A
What's
going
on
and
what
you
want
to
do
next,
you're
going
to
be
in
a
really
rough
time
when
disaster
does
inevitably
strike,
we
also
see
chain
of
command
somebody's
on
call
and
they
get
a
notification
that
notification
is
escalated
to
an
alert
that
alert
to
a
critical
alert.
Next
thing
you
know
in
your
production
system,
is
offline,
you're
compromised,
something's,
going
on,
and
what's
next,
who
do
you
call?
What
button
do
you
push?
Which
email
do
you
send?
Where
do
you
go?
A
There's
nothing
worse
than
getting
a
a
page
at
three
o'clock
in
the
morning
and
feeling
completely
isolated
all
alone,
without
knowing
what
to
do
next
and
trying
to
fix
the
entire
thing
by
yourself
so
having
a
chain
of
command
knowing
the
next
steps
and
it
being
second
nature
so
that
you
don't
even
have
to
think
about
it
is
going
to
be
critical
to
any
sort
of
healthy
response
plan
documentation
right.
Where
do
I
go?
What
do
I
do?
Which
book
do
I
pick
up?
Which
page
do
I
turn
to?
A
These
are
all
important
things
that
are
going
to
be
critical
as
you
and
your
team
start
actually
being
in
the
moment
at
runtime,
recovering
from
some
sort
of
incident
and
last
but
not
least,
a
regression.
A
regression
is
just
a
fancy
way
of
saying.
I
want
to
prevent
this
from
happening
again.
So
in
computer
science
we
write
regression
tests.
These
are
ways
of
proving
that
you
and
your
system
are
not
going
to
be
vulnerable
or
liable
to
the
same
thing
that
they
were
in
the
past.
A
So
again,
let's,
let's
do
a
quick
overview.
We
look
at
the
outbreak,
the
warning
signs
and
we
looked
at
what
it
was
like
the
the
day
we
got
the
the
first
alarm,
especially
with
the
the
pandemic
out
of
out
of
washington
state.
We
look
at
responding
to
that.
The
importance
of
quarantine,
known
infection
or
known
vulnerabilities,
and
we
talked
about
the
the
problems
and
the
good
things
with
information
and
misinformation
sharing
further
response.
We
talked
about
the
importance
of
prevention
and
detection
and
we
looked
at
a
look
at
the
future.