SlideShare a Scribd company logo

SDN Security: Two Sides of the Same Coin

•
•
Zivaro Inc
Zivaro Inc

When it comes to Software Defined Networking (SDN) Security there are two sides of the story. This webinar addresses both sides – what security vulnerabilities exist in modern SDN technologies and how SDN technologies can create new security protections. Also included are use cases that SDN solutions can provide and the new applications of SDN that can secure modern enterprise and data center environments. Presented by GTRI CTO, Scott Hogg, in a webinar on June 9, 2016. For more information, visit http://www.gtri.com/.

Related slideshows

Network address translation
Network address translationNetwork address translation
Network address translation
 
Network Virtualization
Network VirtualizationNetwork Virtualization
Network Virtualization
 
LAN Security
LAN Security LAN Security
LAN Security
 
1 of 29
WWW.GTRI.COM SDN Security: Two Sides of the Same Coin Scott Hogg, CTO GTRI CCIE #5133, CISSP #4610 Thursday June 9, 2016 © 2016 Global Technology Resources, Inc. All rights reserved.
© 2016 Global Technology Resources, Inc. All Rights Reserved. 2 Today’s Agenda • Brief Review of Software Defined Networking (SDN) • Heads: o Attack Vectors for SDN Systems o Securing an SDN System • Tails: o SDN Security Use Cases and Applications • Open Discussion (time permitting)
Defining SDN • Software-Defined Networking is an approach to networking that separates the control plane from the forwarding plane to support virtualization. • SDN is a new paradigm for network virtualization.
SDN High-Level Architecture Controller Network Element Network Element Network Element Network Element Application Layer Or SDN Layer Virtualized Application Services Northbound API Southbound API Control Layer Or Controller Layer Data Plane Layer Or Infrastructure Layer Agent Agent Agent Agent Controller East/West Interface
SDN Benefits • Greater span of control and network analytics and response. • Better intelligence with a global view of the network rather than each network element looking at the network from its own viewpoint. • Improved application experience and empower the network owner/operator. • Rapid deployment of applications using networking that supports the application’s specific needs. • Simplified and automated IT administration. • Opportunity to open up the network to a diverse set of vendors and disaggregation.
SDN Use Cases
SDN Use Cases
Heads: Security of SDN Systems • There are several attack vectors on SDN systems. The more common SDN security concerns include: o Attacks targeting the SDN controller – either DoS or to instantiate new flows (spoofing northbound API messages or spoofing southbound flows) o Attacker creates their own controller and gets network elements to receive flows from that controller – spoofing flows from the legitimate controller o Targeting the network elements – DoS or to instantiate new flows o Attacking the DCI protocol – NVGRE, STT, VXLAN – these protocols may lack authentication, with no encryption – this is either part of the protocol design, or the way the vendor has implemented the protocol © 2016 Global Technology Resources, Inc. All Rights Reserved. 8
SDN Security Considerations © 2016 Global Technology Resources, Inc. All Rights Reserved. 9 Controller Network Element Network Element Network Element Network Element SDN Layer Virtualized Application Services Northbound API Southbound API Controller Layer Data Plane Layer Agent Agent Agent Agent Controller
SDN Vulnerability Genome Project © 2016 Global Technology Resources, Inc. All Rights Reserved. 10 Source: http://sdnsecurity.org/project_SDN-Security-Vulnerbility-attack-list.html
Recent SDN System Vulnerabilities • Some versions of SDN systems may contain other opensource software that is discovered to have vulnerabilities: bash, OpenSSH, OpenSSL, ntpd • Several vulnerabilities have been reported and fixed within OpenDaylight o https://wiki.opendaylight.org/view/Security_Advisories • Netdump vulnerability took 4 months to correct o http://seclists.org/bugtraq/2014/Aug/75 • Now OpenDaylight project has security team in place • ONIE vulnerabilities identified in BigSwitch’s Switch Light controller, Cumulus Linux, Mellanox-OS (August 2015) • CVE-2015-5699 - Cumulus Linux's Switch Configuration Tools Backend, clcmd_server, Vulnerable to Local Privilege Escalation (August 11, 2015) • August 3, 2015 – Cisco APIC root access vulnerability o http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa- 20150722-apic © 2016 Global Technology Resources, Inc. All Rights Reserved. 11
Hardening an SDN System • Use TLS 1.2 (or UDP/DTLS) to authenticate and encrypt traffic between network device agent and controller, authenticate controller and network devices/SDN agent using certificates • High-Availability controller architecture • Prevent unauthorized access to SDN control network • Use Out-of-Band (OOB) network for control traffic, OOB and secure protocols for controller management and northbound communications • Harden the controller and the network elements (typical host hardening) • Closely monitor controllers for suspicious activity • Secure coding practices for all northbound applications requesting SDN resources • Ability to validate flows in network device tables against controller policy • Use Data Center Interconnect (DCI) protocols that can authenticate tunnel endpoints and secure tunneled traffic © 2016 Global Technology Resources, Inc. All Rights Reserved. 12
Tails: SDN Security-Specific Use Case • SDN allows for creative new approaches to security • We will now review 6 SDN uses cases for security 1. Traffic Filtering with SDN 2. Network Slicing, Campus Slicing, Multi-Tenancy, Enclaves, Isolation, Network Segmentation 3. DDoS Mitigation 4. Network Access Control (NAC) 5. Security Traffic Monitoring 6. Moving Target Defense (MTD) © 2016 Global Technology Resources, Inc. All Rights Reserved. 13
Traffic Filtering with SDN • That which is not permitted is denied – make the SDN switches not transparent learning/forwarding • Cisco APIC-EM configures the ACI policy for traffic permitted between End Point Groups (EPGs) and for traffic steering – if not permitted, traffic is dropped • Integrate SDN system with Cisco Identity Services Engine (ISE) for device profiling, user authentication, SGT, TrustSec tagging • Traffic steering toward firewall or content filter, security service insertion between client and server © 2016 Global Technology Resources, Inc. All Rights Reserved. 14
SDN Switches As Firewalls? © 2016 Global Technology Resources, Inc. All Rights Reserved. 15 SDN Controller Network Element SDN Layer Northbound API Southbound API Controller Layer Data Plane Layer Agent Agent Agent Agent Network Element Network Element Network Element Software-Defined Perimeter (SDP)
Network Segmentation with SDN • Separating the network into logically separated networks • Network Slicing, Campus Slicing, Secured Enclaves, Micro- Segmentation, Virtual Routing and Forwarding, etc. • Done by adding a slicing layer between the control plane and the data plane, policies are slice-specific • Enforce strong isolation between slices - actions in one slice do not affect another (Flowspace) • Examples: Cisco XNC with Networking Slicing application, FlowVisor is a special purpose OpenFlow controller that acts as a transparent proxy between OpenFlow switches and multiple OpenFlow controllers © 2016 Global Technology Resources, Inc. All Rights Reserved. 16
Network Segmentation with SDN • “Network Slicing” Use Case © 2016 Global Technology Resources, Inc. All Rights Reserved. 17 Source: Cisco Extensible Network Controller Topology-Independent Forwarding and Network Slicing Applications http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps13397/ps13400/data_sheet_c78-729458.pdf
Network Segmentation with SDN • FlowVisor performs policy checks across flowspace and enforces isolation between each slice © 2016 Global Technology Resources, Inc. All Rights Reserved. 18 Source: Can the Production Network Be the Testbed? By Rob Sherwood, Glen Gibb, Kok-Kiong Yap, Guido Appenzeller ,Martin Casado, Nick McKeown, Guru Parulkar
DDoS Mitigation with SDN • SDN can be used to create a DDoS mitigation system • SDN network sends DDoS telemetry data to the DDoS detection system (volumetric, app attacks, protocol DDoS) • DDoS detection system communicates with northbound API which configures the policy on the controller for the destination of the attack • SDN controller sends flows to network devices to drop suspicious inbound traffic toward victim • Cleaned traffic is allowed to pass toward the destination • Examples: Radware Defense Flow, Radware Defense4All in ODL Helium, A10 Networks Thunder Threat Protection System, others… © 2016 Global Technology Resources, Inc. All Rights Reserved. 19
DDoS Mitigation with SDN • Radware DefenseFlow integrates with Cisco’s XNC, OpenDaylight, BigSwitch Floodlight, and NEC’s ProgrammableFlow OpenFlow-based switches and controller © 2016 Global Technology Resources, Inc. All Rights Reserved. 20 Source: http://www.radware.com/Products/DefenseFlow/
Network Access Control (NAC) with SDN • SDN systems can prevent unauthorized access or isolate compromised hosts to a quarantine network, Automated Malware Quarantine (AMQ) • SDN systems can intervene in assigning addresses to nodes joining network based on their security posture • Authenticated end nodes are able to send/receive if they pass security checks (AV running/updated, patched, …) • End nodes can only send/receive with their assigned IP/MAC addresses o Source Address Validation Improvements (SAVI) and First Hop Security (FHS) • Or direct end-node traffic to Cisco Cloud Threat Defense system, detect the issue, check with ISE, set SGT=BAD, to contain the traffic • Examples: Cisco Cloud Threat Defense, HP VAN Sentinel Security Application © 2016 Global Technology Resources, Inc. All Rights Reserved. 21
SDN Security Components © 2016 Global Technology Resources, Inc. All Rights Reserved. 22 Source: 2014 Cisco Live BRKSEC-2760
Security Monitoring with SDN • Switches often lack sufficient resources to perform packet/port mirroring/taps o Every IT silo/team wants their own tap/SPAN session (Network Packet Broker (NPB)) • Bi-directional packet capture is much better than NetFlow • Dedicated copper/optical packet monitoring switches can be very expensive, many taps are required – no blocking ability • Tap Aggregation is an application that is simple for a SDN controller and uses low-cost SDN-capable network devices • Examples: Cisco XNC with Monitor Manager and Nexus 3000 Tap Aggregation Switch, BigSwitch Big Tap Monitoring Fabric, Microsoft Distributed Ethernet Monitoring (DEMon) © 2016 Global Technology Resources, Inc. All Rights Reserved. 23 Using SDN to Create a Packet Monitoring System http://www.networkworld.com/article/2226003/cisco-subnet/using-sdn-to-create-a-packet-monitoring-system.html
Security Monitoring with SDN • Cisco XNC Monitor Manager, Cisco Nexus Data Broker © 2016 Global Technology Resources, Inc. All Rights Reserved. 24 Source: Cisco Nexus Data Broker http://www.cisco.com/c/en/us/products/cloud-systems-management/nexus-data-broker/index.html
Moving Target IPv6 Defense (MT6D) • MT6D is a system created by graduate students in the Information Technology Security Laboratory at Virginia Tech to obscure IPv6 addresses • Periodically hiding/changing characteristics of victim to make it more difficult to find/attack © 2016 Global Technology Resources, Inc. All Rights Reserved. 25 Source: http://www4.ncsu.edu/~hp/Panos.pdf
SDN Security Summary • SDN has the potential to provide many new creative ways to network and secure systems • SDN represents a new way of thinking, we all need to be cognizant about this technology shift • Heads: SDN systems are vulnerable to threats, but SDN implementations can be hardened against security attacks • Tails: SDN systems can provide innovative security applications that are not possible with traditional methods © 2016 Global Technology Resources, Inc. All Rights Reserved. 26
SDN & Security Resources • Solution Brief: SDN Security Considerations in the Data Center o https://www.opennetworking.org/solution-brief-sdn-security-considerations-in-the- data-center • SDN Security Challenges in SDN Environments o https://www.sdxcentral.com/resources/security/security-challenges-sdn-software- defined-networks/ • SDN Security Attack Vectors and SDN Hardening o http://www.networkworld.com/article/2840273/sdn/sdn-security-attack-vectors-and- sdn-hardening.html • With Cisco ACI, Do You Still Need A Firewall? o https://cisco- marketing.hosted.jivesoftware.com/people/shogg@gtri.com/blog/2015/03/02/with- cisco-aci-do-you-still-need-a-firewall • Is an SDN Switch A New Form of a Firewall? o http://www.networkworld.com/article/2905257/sdn/is-an-sdn-switch-a-new-form-of- a-firewall.html © 2016 Global Technology Resources, Inc. All Rights Reserved. 27
FREE SDN Technology Review • We are offering a FREE 3-hour (~1/2 day) SDN technology review for your company • Bring your networking, security, DevOps, and other technology teams together • Review SDN capabilities within your existing networked systems • Discuss SDN architecture and design options • Review network automation and network programmability potential • Engage in conversation on securely deploying IPv6 and using SDN for security
WWW.GTRI.COM Questions and Answers Next Steps Thank you! SHogg@GTRI.com 303-949-4865 @scotthogg

More Related Content

SDN Security: Two Sides of the Same Coin

  • 1. WWW.GTRI.COM SDN Security: Two Sides of the Same Coin Scott Hogg, CTO GTRI CCIE #5133, CISSP #4610 Thursday June 9, 2016 © 2016 Global Technology Resources, Inc. All rights reserved.
  • 2. © 2016 Global Technology Resources, Inc. All Rights Reserved. 2 Today’s Agenda • Brief Review of Software Defined Networking (SDN) • Heads: o Attack Vectors for SDN Systems o Securing an SDN System • Tails: o SDN Security Use Cases and Applications • Open Discussion (time permitting)
  • 3. Defining SDN • Software-Defined Networking is an approach to networking that separates the control plane from the forwarding plane to support virtualization. • SDN is a new paradigm for network virtualization.
  • 4. SDN High-Level Architecture Controller Network Element Network Element Network Element Network Element Application Layer Or SDN Layer Virtualized Application Services Northbound API Southbound API Control Layer Or Controller Layer Data Plane Layer Or Infrastructure Layer Agent Agent Agent Agent Controller East/West Interface
  • 5. SDN Benefits • Greater span of control and network analytics and response. • Better intelligence with a global view of the network rather than each network element looking at the network from its own viewpoint. • Improved application experience and empower the network owner/operator. • Rapid deployment of applications using networking that supports the application’s specific needs. • Simplified and automated IT administration. • Opportunity to open up the network to a diverse set of vendors and disaggregation.
  • 8. Heads: Security of SDN Systems • There are several attack vectors on SDN systems. The more common SDN security concerns include: o Attacks targeting the SDN controller – either DoS or to instantiate new flows (spoofing northbound API messages or spoofing southbound flows) o Attacker creates their own controller and gets network elements to receive flows from that controller – spoofing flows from the legitimate controller o Targeting the network elements – DoS or to instantiate new flows o Attacking the DCI protocol – NVGRE, STT, VXLAN – these protocols may lack authentication, with no encryption – this is either part of the protocol design, or the way the vendor has implemented the protocol © 2016 Global Technology Resources, Inc. All Rights Reserved. 8
  • 9. SDN Security Considerations © 2016 Global Technology Resources, Inc. All Rights Reserved. 9 Controller Network Element Network Element Network Element Network Element SDN Layer Virtualized Application Services Northbound API Southbound API Controller Layer Data Plane Layer Agent Agent Agent Agent Controller
  • 10. SDN Vulnerability Genome Project © 2016 Global Technology Resources, Inc. All Rights Reserved. 10 Source: http://sdnsecurity.org/project_SDN-Security-Vulnerbility-attack-list.html
  • 11. Recent SDN System Vulnerabilities • Some versions of SDN systems may contain other opensource software that is discovered to have vulnerabilities: bash, OpenSSH, OpenSSL, ntpd • Several vulnerabilities have been reported and fixed within OpenDaylight o https://wiki.opendaylight.org/view/Security_Advisories • Netdump vulnerability took 4 months to correct o http://seclists.org/bugtraq/2014/Aug/75 • Now OpenDaylight project has security team in place • ONIE vulnerabilities identified in BigSwitch’s Switch Light controller, Cumulus Linux, Mellanox-OS (August 2015) • CVE-2015-5699 - Cumulus Linux's Switch Configuration Tools Backend, clcmd_server, Vulnerable to Local Privilege Escalation (August 11, 2015) • August 3, 2015 – Cisco APIC root access vulnerability o http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa- 20150722-apic © 2016 Global Technology Resources, Inc. All Rights Reserved. 11
  • 12. Hardening an SDN System • Use TLS 1.2 (or UDP/DTLS) to authenticate and encrypt traffic between network device agent and controller, authenticate controller and network devices/SDN agent using certificates • High-Availability controller architecture • Prevent unauthorized access to SDN control network • Use Out-of-Band (OOB) network for control traffic, OOB and secure protocols for controller management and northbound communications • Harden the controller and the network elements (typical host hardening) • Closely monitor controllers for suspicious activity • Secure coding practices for all northbound applications requesting SDN resources • Ability to validate flows in network device tables against controller policy • Use Data Center Interconnect (DCI) protocols that can authenticate tunnel endpoints and secure tunneled traffic © 2016 Global Technology Resources, Inc. All Rights Reserved. 12
  • 13. Tails: SDN Security-Specific Use Case • SDN allows for creative new approaches to security • We will now review 6 SDN uses cases for security 1. Traffic Filtering with SDN 2. Network Slicing, Campus Slicing, Multi-Tenancy, Enclaves, Isolation, Network Segmentation 3. DDoS Mitigation 4. Network Access Control (NAC) 5. Security Traffic Monitoring 6. Moving Target Defense (MTD) © 2016 Global Technology Resources, Inc. All Rights Reserved. 13
  • 14. Traffic Filtering with SDN • That which is not permitted is denied – make the SDN switches not transparent learning/forwarding • Cisco APIC-EM configures the ACI policy for traffic permitted between End Point Groups (EPGs) and for traffic steering – if not permitted, traffic is dropped • Integrate SDN system with Cisco Identity Services Engine (ISE) for device profiling, user authentication, SGT, TrustSec tagging • Traffic steering toward firewall or content filter, security service insertion between client and server © 2016 Global Technology Resources, Inc. All Rights Reserved. 14
  • 15. SDN Switches As Firewalls? © 2016 Global Technology Resources, Inc. All Rights Reserved. 15 SDN Controller Network Element SDN Layer Northbound API Southbound API Controller Layer Data Plane Layer Agent Agent Agent Agent Network Element Network Element Network Element Software-Defined Perimeter (SDP)
  • 16. Network Segmentation with SDN • Separating the network into logically separated networks • Network Slicing, Campus Slicing, Secured Enclaves, Micro- Segmentation, Virtual Routing and Forwarding, etc. • Done by adding a slicing layer between the control plane and the data plane, policies are slice-specific • Enforce strong isolation between slices - actions in one slice do not affect another (Flowspace) • Examples: Cisco XNC with Networking Slicing application, FlowVisor is a special purpose OpenFlow controller that acts as a transparent proxy between OpenFlow switches and multiple OpenFlow controllers © 2016 Global Technology Resources, Inc. All Rights Reserved. 16
  • 17. Network Segmentation with SDN • “Network Slicing” Use Case © 2016 Global Technology Resources, Inc. All Rights Reserved. 17 Source: Cisco Extensible Network Controller Topology-Independent Forwarding and Network Slicing Applications http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps13397/ps13400/data_sheet_c78-729458.pdf
  • 18. Network Segmentation with SDN • FlowVisor performs policy checks across flowspace and enforces isolation between each slice © 2016 Global Technology Resources, Inc. All Rights Reserved. 18 Source: Can the Production Network Be the Testbed? By Rob Sherwood, Glen Gibb, Kok-Kiong Yap, Guido Appenzeller ,Martin Casado, Nick McKeown, Guru Parulkar
  • 19. DDoS Mitigation with SDN • SDN can be used to create a DDoS mitigation system • SDN network sends DDoS telemetry data to the DDoS detection system (volumetric, app attacks, protocol DDoS) • DDoS detection system communicates with northbound API which configures the policy on the controller for the destination of the attack • SDN controller sends flows to network devices to drop suspicious inbound traffic toward victim • Cleaned traffic is allowed to pass toward the destination • Examples: Radware Defense Flow, Radware Defense4All in ODL Helium, A10 Networks Thunder Threat Protection System, others… © 2016 Global Technology Resources, Inc. All Rights Reserved. 19
  • 20. DDoS Mitigation with SDN • Radware DefenseFlow integrates with Cisco’s XNC, OpenDaylight, BigSwitch Floodlight, and NEC’s ProgrammableFlow OpenFlow-based switches and controller © 2016 Global Technology Resources, Inc. All Rights Reserved. 20 Source: http://www.radware.com/Products/DefenseFlow/
  • 21. Network Access Control (NAC) with SDN • SDN systems can prevent unauthorized access or isolate compromised hosts to a quarantine network, Automated Malware Quarantine (AMQ) • SDN systems can intervene in assigning addresses to nodes joining network based on their security posture • Authenticated end nodes are able to send/receive if they pass security checks (AV running/updated, patched, …) • End nodes can only send/receive with their assigned IP/MAC addresses o Source Address Validation Improvements (SAVI) and First Hop Security (FHS) • Or direct end-node traffic to Cisco Cloud Threat Defense system, detect the issue, check with ISE, set SGT=BAD, to contain the traffic • Examples: Cisco Cloud Threat Defense, HP VAN Sentinel Security Application © 2016 Global Technology Resources, Inc. All Rights Reserved. 21
  • 22. SDN Security Components © 2016 Global Technology Resources, Inc. All Rights Reserved. 22 Source: 2014 Cisco Live BRKSEC-2760
  • 23. Security Monitoring with SDN • Switches often lack sufficient resources to perform packet/port mirroring/taps o Every IT silo/team wants their own tap/SPAN session (Network Packet Broker (NPB)) • Bi-directional packet capture is much better than NetFlow • Dedicated copper/optical packet monitoring switches can be very expensive, many taps are required – no blocking ability • Tap Aggregation is an application that is simple for a SDN controller and uses low-cost SDN-capable network devices • Examples: Cisco XNC with Monitor Manager and Nexus 3000 Tap Aggregation Switch, BigSwitch Big Tap Monitoring Fabric, Microsoft Distributed Ethernet Monitoring (DEMon) © 2016 Global Technology Resources, Inc. All Rights Reserved. 23 Using SDN to Create a Packet Monitoring System http://www.networkworld.com/article/2226003/cisco-subnet/using-sdn-to-create-a-packet-monitoring-system.html
  • 24. Security Monitoring with SDN • Cisco XNC Monitor Manager, Cisco Nexus Data Broker © 2016 Global Technology Resources, Inc. All Rights Reserved. 24 Source: Cisco Nexus Data Broker http://www.cisco.com/c/en/us/products/cloud-systems-management/nexus-data-broker/index.html
  • 25. Moving Target IPv6 Defense (MT6D) • MT6D is a system created by graduate students in the Information Technology Security Laboratory at Virginia Tech to obscure IPv6 addresses • Periodically hiding/changing characteristics of victim to make it more difficult to find/attack © 2016 Global Technology Resources, Inc. All Rights Reserved. 25 Source: http://www4.ncsu.edu/~hp/Panos.pdf
  • 26. SDN Security Summary • SDN has the potential to provide many new creative ways to network and secure systems • SDN represents a new way of thinking, we all need to be cognizant about this technology shift • Heads: SDN systems are vulnerable to threats, but SDN implementations can be hardened against security attacks • Tails: SDN systems can provide innovative security applications that are not possible with traditional methods © 2016 Global Technology Resources, Inc. All Rights Reserved. 26
  • 27. SDN & Security Resources • Solution Brief: SDN Security Considerations in the Data Center o https://www.opennetworking.org/solution-brief-sdn-security-considerations-in-the- data-center • SDN Security Challenges in SDN Environments o https://www.sdxcentral.com/resources/security/security-challenges-sdn-software- defined-networks/ • SDN Security Attack Vectors and SDN Hardening o http://www.networkworld.com/article/2840273/sdn/sdn-security-attack-vectors-and- sdn-hardening.html • With Cisco ACI, Do You Still Need A Firewall? o https://cisco- marketing.hosted.jivesoftware.com/people/shogg@gtri.com/blog/2015/03/02/with- cisco-aci-do-you-still-need-a-firewall • Is an SDN Switch A New Form of a Firewall? o http://www.networkworld.com/article/2905257/sdn/is-an-sdn-switch-a-new-form-of- a-firewall.html © 2016 Global Technology Resources, Inc. All Rights Reserved. 27
  • 28. FREE SDN Technology Review • We are offering a FREE 3-hour (~1/2 day) SDN technology review for your company • Bring your networking, security, DevOps, and other technology teams together • Review SDN capabilities within your existing networked systems • Discuss SDN architecture and design options • Review network automation and network programmability potential • Engage in conversation on securely deploying IPv6 and using SDN for security
  • 29. WWW.GTRI.COM Questions and Answers Next Steps Thank you! SHogg@GTRI.com 303-949-4865 @scotthogg